diff --git a/bin/contentctl_project/contentctl_core/application/factory/ba_factory.py b/bin/contentctl_project/contentctl_core/application/factory/ba_factory.py index 92fc4343f3..e611a15304 100644 --- a/bin/contentctl_project/contentctl_core/application/factory/ba_factory.py +++ b/bin/contentctl_project/contentctl_core/application/factory/ba_factory.py @@ -1,5 +1,7 @@ import os +import sys +from pydantic import ValidationError from dataclasses import dataclass from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentType @@ -44,15 +46,25 @@ class BAFactory(): else: files = Utils.get_all_yml_files_from_directory(os.path.join(self.input_dto.input_path, str(type.name))) + validation_error_found = False + for file in files: if 'ssa__' in file: - if type == SecurityContentType.detections: - self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, [], [], [], self.output_dto.tests, {}, [], []) - detection = self.input_dto.detection_builder.getObject() - if not detection.deprecated and not detection.experimental: - self.output_dto.detections.append(detection) - elif type == SecurityContentType.unit_tests: - self.input_dto.director.constructTest(self.input_dto.basic_builder, file) - test = self.input_dto.basic_builder.getObject() - self.output_dto.tests.append(test) - \ No newline at end of file + try: + if type == SecurityContentType.detections: + self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, [], [], [], self.output_dto.tests, {}, [], []) + detection = self.input_dto.detection_builder.getObject() + if not detection.deprecated and not detection.experimental: + self.output_dto.detections.append(detection) + elif type == SecurityContentType.unit_tests: + self.input_dto.director.constructTest(self.input_dto.basic_builder, file) + test = self.input_dto.basic_builder.getObject() + self.output_dto.tests.append(test) + + except ValidationError as e: + print('\nValidation Error for file ' + file) + print(e) + validation_error_found = True + + if validation_error_found: + sys.exit(1) \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_core/application/factory/factory.py b/bin/contentctl_project/contentctl_core/application/factory/factory.py index 888dfbed82..1b41524232 100644 --- a/bin/contentctl_project/contentctl_core/application/factory/factory.py +++ b/bin/contentctl_project/contentctl_core/application/factory/factory.py @@ -1,5 +1,7 @@ import os +import sys +from pydantic import ValidationError from dataclasses import dataclass from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentProduct @@ -59,9 +61,7 @@ class Factory(): self.createSecurityContent(SecurityContentType.deployments) self.createSecurityContent(SecurityContentType.baselines) self.createSecurityContent(SecurityContentType.investigations) - self.createSecurityContent(SecurityContentType.detections) # execution only for playbook enrichment self.createSecurityContent(SecurityContentType.playbooks) - self.output_dto.detections = [] self.createSecurityContent(SecurityContentType.detections) self.createSecurityContent(SecurityContentType.stories) @@ -75,50 +75,60 @@ class Factory(): else: files = Utils.get_all_yml_files_from_directory(os.path.join(self.input_dto.input_path, str(type.name))) + validation_error_found = False + for file in files: if not 'ssa__' in file: - if type == SecurityContentType.lookups: - self.input_dto.director.constructLookup(self.input_dto.basic_builder, file) - self.output_dto.lookups.append(self.input_dto.basic_builder.getObject()) - - elif type == SecurityContentType.macros: - self.input_dto.director.constructMacro(self.input_dto.basic_builder, file) - self.output_dto.macros.append(self.input_dto.basic_builder.getObject()) - - elif type == SecurityContentType.deployments: - self.input_dto.director.constructDeployment(self.input_dto.basic_builder, file) - self.output_dto.deployments.append(self.input_dto.basic_builder.getObject()) - - elif type == SecurityContentType.playbooks: - self.input_dto.director.constructPlaybook(self.input_dto.playbook_builder, file, self.output_dto.detections) - self.output_dto.playbooks.append(self.input_dto.playbook_builder.getObject()) - - elif type == SecurityContentType.baselines: - self.input_dto.director.constructBaseline(self.input_dto.baseline_builder, file, self.output_dto.deployments) - baseline = self.input_dto.baseline_builder.getObject() - self.output_dto.baselines.append(baseline) - - elif type == SecurityContentType.investigations: - self.input_dto.director.constructInvestigation(self.input_dto.investigation_builder, file) - investigation = self.input_dto.investigation_builder.getObject() - self.output_dto.investigations.append(investigation) + try: + if type == SecurityContentType.lookups: + self.input_dto.director.constructLookup(self.input_dto.basic_builder, file) + self.output_dto.lookups.append(self.input_dto.basic_builder.getObject()) + + elif type == SecurityContentType.macros: + self.input_dto.director.constructMacro(self.input_dto.basic_builder, file) + self.output_dto.macros.append(self.input_dto.basic_builder.getObject()) + + elif type == SecurityContentType.deployments: + self.input_dto.director.constructDeployment(self.input_dto.basic_builder, file) + self.output_dto.deployments.append(self.input_dto.basic_builder.getObject()) + + elif type == SecurityContentType.playbooks: + self.input_dto.director.constructPlaybook(self.input_dto.playbook_builder, file) + self.output_dto.playbooks.append(self.input_dto.playbook_builder.getObject()) + + elif type == SecurityContentType.baselines: + self.input_dto.director.constructBaseline(self.input_dto.baseline_builder, file, self.output_dto.deployments) + baseline = self.input_dto.baseline_builder.getObject() + self.output_dto.baselines.append(baseline) + + elif type == SecurityContentType.investigations: + self.input_dto.director.constructInvestigation(self.input_dto.investigation_builder, file) + investigation = self.input_dto.investigation_builder.getObject() + self.output_dto.investigations.append(investigation) - elif type == SecurityContentType.stories: - self.input_dto.director.constructStory(self.input_dto.story_builder, file, - self.output_dto.detections, self.output_dto.baselines, self.output_dto.investigations) - story = self.input_dto.story_builder.getObject() - self.output_dto.stories.append(story) - - elif type == SecurityContentType.detections: - self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, - self.output_dto.deployments, self.output_dto.playbooks, self.output_dto.baselines, - self.output_dto.tests, self.input_dto.attack_enrichment, self.output_dto.macros, - self.output_dto.lookups) - detection = self.input_dto.detection_builder.getObject() - self.output_dto.detections.append(detection) - - elif type == SecurityContentType.unit_tests: - self.input_dto.director.constructTest(self.input_dto.basic_builder, file) - test = self.input_dto.basic_builder.getObject() - self.output_dto.tests.append(test) - + elif type == SecurityContentType.stories: + self.input_dto.director.constructStory(self.input_dto.story_builder, file, + self.output_dto.detections, self.output_dto.baselines, self.output_dto.investigations) + story = self.input_dto.story_builder.getObject() + self.output_dto.stories.append(story) + + elif type == SecurityContentType.detections: + self.input_dto.director.constructDetection(self.input_dto.detection_builder, file, + self.output_dto.deployments, self.output_dto.playbooks, self.output_dto.baselines, + self.output_dto.tests, self.input_dto.attack_enrichment, self.output_dto.macros, + self.output_dto.lookups) + detection = self.input_dto.detection_builder.getObject() + self.output_dto.detections.append(detection) + + elif type == SecurityContentType.unit_tests: + self.input_dto.director.constructTest(self.input_dto.basic_builder, file) + test = self.input_dto.basic_builder.getObject() + self.output_dto.tests.append(test) + + except ValidationError as e: + print('\nValidation Error for file ' + file) + print(e) + validation_error_found = True + + if validation_error_found: + sys.exit(1) \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_core/application/use_cases/doc_gen.py b/bin/contentctl_project/contentctl_core/application/use_cases/doc_gen.py index ef39173535..a90158d20d 100644 --- a/bin/contentctl_project/contentctl_core/application/use_cases/doc_gen.py +++ b/bin/contentctl_project/contentctl_core/application/use_cases/doc_gen.py @@ -20,4 +20,6 @@ class DocGen: factory = Factory(factory_output_dto) factory.execute(input_dto.factory_input_dto) - input_dto.adapter.writeObjects([factory_output_dto.stories, factory_output_dto.detections, factory_output_dto.playbooks], input_dto.output_path) \ No newline at end of file + input_dto.adapter.writeObjects([factory_output_dto.stories, factory_output_dto.detections, factory_output_dto.playbooks], input_dto.output_path) + + print('Documentation generation of security content successful.') \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_core/application/use_cases/generate.py b/bin/contentctl_project/contentctl_core/application/use_cases/generate.py index 6b59845c84..3f3f4f5ce2 100644 --- a/bin/contentctl_project/contentctl_core/application/use_cases/generate.py +++ b/bin/contentctl_project/contentctl_core/application/use_cases/generate.py @@ -55,4 +55,6 @@ class Generate: input_dto.adapter.writeObjects(factory_output_dto.investigations, input_dto.output_path, SecurityContentType.investigations) input_dto.adapter.writeObjects(factory_output_dto.lookups, input_dto.output_path, SecurityContentType.lookups) input_dto.adapter.writeObjects(factory_output_dto.macros, input_dto.output_path, SecurityContentType.macros) - input_dto.adapter.writeObjects(factory_output_dto.deployments, input_dto.output_path, SecurityContentType.deployments) \ No newline at end of file + input_dto.adapter.writeObjects(factory_output_dto.deployments, input_dto.output_path, SecurityContentType.deployments) + + print('Generate of security content successful.') \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_core/application/use_cases/reporting.py b/bin/contentctl_project/contentctl_core/application/use_cases/reporting.py index 298d7baa11..b6db90069e 100644 --- a/bin/contentctl_project/contentctl_core/application/use_cases/reporting.py +++ b/bin/contentctl_project/contentctl_core/application/use_cases/reporting.py @@ -21,4 +21,6 @@ class Reporting: factory.execute(input_dto.factory_input_dto) input_dto.adapter_svg.writeObjects(factory_output_dto.detections, os.path.join(os.path.dirname(__file__), '../../../../reporting')) - input_dto.adapter_attack.writeObjects(factory_output_dto.detections, os.path.join(os.path.dirname(__file__), '../../../../../docs/mitre-map')) \ No newline at end of file + input_dto.adapter_attack.writeObjects(factory_output_dto.detections, os.path.join(os.path.dirname(__file__), '../../../../../docs/mitre-map')) + + print('Reporting of security content successful.') \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_core/application/use_cases/validate.py b/bin/contentctl_project/contentctl_core/application/use_cases/validate.py index 19c8679bf4..a83f831c6e 100644 --- a/bin/contentctl_project/contentctl_core/application/use_cases/validate.py +++ b/bin/contentctl_project/contentctl_core/application/use_cases/validate.py @@ -35,6 +35,8 @@ class Validate: # validate tests self.validate_detection_exist_for_test(factory_output_dto.tests, factory_output_dto.detections) + print('Validation of security content successful.') + def validate_detection_exist_for_test(self, tests : list, detections: list): for test in tests: diff --git a/bin/contentctl_project/contentctl_core/domain/entities/playbook_tags.py b/bin/contentctl_project/contentctl_core/domain/entities/playbook_tags.py index f5bc47693e..0d3b1feed9 100644 --- a/bin/contentctl_project/contentctl_core/domain/entities/playbook_tags.py +++ b/bin/contentctl_project/contentctl_core/domain/entities/playbook_tags.py @@ -9,5 +9,5 @@ class PlaybookTag(BaseModel): playbook_fields: list = None product: list = None playbook_fields: list = None - detection_objects: list = None + detection_objects: list = None \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_playbooks.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_playbooks.j2 index 5872761ffd..81d93f51e1 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_playbooks.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_playbooks.j2 @@ -32,7 +32,7 @@ tags: #### Associated Detections {% if object.tags.detection_objects %} {% for detection in object.tags.detection_objects -%} -* [{{ detection.name }}](/{{ detection.soure }}/{{detection.name|lower|replace(" ", "_")}}/) +* [{{ detection.name }}](/detection/{{ detection.lowercase_name }}/) {% endfor %} {% endif %} diff --git a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_playbooks_page.j2 b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_playbooks_page.j2 index b15521fc0f..53ad365409 100644 --- a/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_playbooks_page.j2 +++ b/bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_playbooks_page.j2 @@ -12,7 +12,7 @@ sidebar: | --------| ---------- | ----------- | {% for playbook in objects -%} {% if playbook.tags.detection_objects -%} -| [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)|{% for detection in playbook.tags.detection_objects -%}[{{ detection.name }}](/{{ detection.source }}/{{detection.name|lower|replace(" ", "_")}}/){%- endfor -%} | {{ playbook.type }} | +| [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)|{% for detection in playbook.tags.detection_objects -%}[{{ detection.name }}]((/detection/{{ detection.lowercase_name }}/) {%- endfor -%} | {{ playbook.type }} | {% else -%} | [{{ playbook.name }}](/playbooks/{{ playbook.name|lower|replace(' ', '_') }}/)| None | {{ playbook.type }} | {% endif -%} diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py index a813ca323c..052fba03ad 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py @@ -20,202 +20,207 @@ class SecurityContentDetectionBuilder(DetectionBuilder): def setObject(self, path: str) -> None: yml_dict = YmlReader.load_file(path) yml_dict["tags"]["name"] = yml_dict["name"] - try: - self.security_content_obj = Detection.parse_obj(yml_dict) - except ValidationError as e: - print('Validation Error for file ' + path) - print(e) - sys.exit(1) - + self.security_content_obj = Detection.parse_obj(yml_dict) self.security_content_obj.source = os.path.split(os.path.dirname(self.security_content_obj.file_path))[-1] def addDeployment(self, deployments: list) -> None: - matched_deployments = [] + if self.security_content_obj: + matched_deployments = [] - for d in deployments: - d_tags = dict(d.tags) - for d_tag in d_tags.keys(): - for attr in dir(self.security_content_obj): - if not (attr.startswith('__') or attr.startswith('_')): - if attr == d_tag: - if type(self.security_content_obj.__getattribute__(attr)) is str: - attr_values = [self.security_content_obj.__getattribute__(attr)] - else: - attr_values = self.security_content_obj.__getattribute__(attr) - - for attr_value in attr_values: - if attr_value == d_tags[d_tag]: - matched_deployments.append(d) + for d in deployments: + d_tags = dict(d.tags) + for d_tag in d_tags.keys(): + for attr in dir(self.security_content_obj): + if not (attr.startswith('__') or attr.startswith('_')): + if attr == d_tag: + if type(self.security_content_obj.__getattribute__(attr)) is str: + attr_values = [self.security_content_obj.__getattribute__(attr)] + else: + attr_values = self.security_content_obj.__getattribute__(attr) + + for attr_value in attr_values: + if attr_value == d_tags[d_tag]: + matched_deployments.append(d) - if len(matched_deployments) == 0: - self.security_content_obj.deployment = None - else: - self.security_content_obj.deployment = matched_deployments[-1] + if len(matched_deployments) == 0: + self.security_content_obj.deployment = None + else: + self.security_content_obj.deployment = matched_deployments[-1] def addRBA(self) -> None: + if self.security_content_obj: + risk_objects = [] + risk_object_user_types = {'user', 'username', 'email address'} + risk_object_system_types = {'device', 'endpoint', 'hostname', 'ip address'} - risk_objects = [] - risk_object_user_types = {'user', 'username', 'email address'} - risk_object_system_types = {'device', 'endpoint', 'hostname', 'ip address'} + if hasattr(self.security_content_obj.tags, 'observable') and hasattr(self.security_content_obj.tags, 'risk_score'): + for entity in self.security_content_obj.tags.observable: + risk_object = dict() + if entity['type'].lower() in risk_object_user_types: + for r in entity['role']: + if 'attacker' == r.lower() or 'victim' ==r.lower(): + risk_object['risk_object_type'] = 'user' + risk_object['risk_object_field'] = entity['name'] + risk_object['risk_score'] = self.security_content_obj.tags.risk_score + risk_objects.append(risk_object) - if hasattr(self.security_content_obj.tags, 'observable') and hasattr(self.security_content_obj.tags, 'risk_score'): - for entity in self.security_content_obj.tags.observable: - risk_object = dict() - if entity['type'].lower() in risk_object_user_types: - for r in entity['role']: - if 'attacker' == r.lower() or 'victim' ==r.lower(): - risk_object['risk_object_type'] = 'user' - risk_object['risk_object_field'] = entity['name'] - risk_object['risk_score'] = self.security_content_obj.tags.risk_score - risk_objects.append(risk_object) + elif entity['type'].lower() in risk_object_system_types: + for r in entity['role']: + if 'attacker' == r.lower() or 'victim' ==r.lower(): + risk_object['risk_object_type'] = 'system' + risk_object['risk_object_field'] = entity['name'] + risk_object['risk_score'] = self.security_content_obj.tags.risk_score + risk_objects.append(risk_object) + else: + risk_object['threat_object_field'] = entity['name'] + risk_object['threat_object_type'] = entity['type'].lower() + risk_objects.append(risk_object) + continue - elif entity['type'].lower() in risk_object_system_types: - for r in entity['role']: - if 'attacker' == r.lower() or 'victim' ==r.lower(): - risk_object['risk_object_type'] = 'system' - risk_object['risk_object_field'] = entity['name'] - risk_object['risk_score'] = self.security_content_obj.tags.risk_score - risk_objects.append(risk_object) - else: - risk_object['threat_object_field'] = entity['name'] - risk_object['threat_object_type'] = entity['type'].lower() - risk_objects.append(risk_object) - continue + if self.security_content_obj.tags.risk_score >= 80: + self.security_content_obj.tags.risk_severity = 'high' + elif (self.security_content_obj.tags.risk_score >= 50 and self.security_content_obj.tags.risk_score <= 79): + self.security_content_obj.tags.risk_severity = 'medium' + else: + self.security_content_obj.tags.risk_severity = 'low' - if self.security_content_obj.tags.risk_score >= 80: - self.security_content_obj.tags.risk_severity = 'high' - elif (self.security_content_obj.tags.risk_score >= 50 and self.security_content_obj.tags.risk_score <= 79): - self.security_content_obj.tags.risk_severity = 'medium' - else: - self.security_content_obj.tags.risk_severity = 'low' - - self.security_content_obj.risk = risk_objects + self.security_content_obj.risk = risk_objects def addNesFields(self) -> None: - nes_fields_matches = [] - if self.security_content_obj.deployment: - if self.security_content_obj.deployment.notable: - for nes_field in self.security_content_obj.deployment.notable.nes_fields: - if (self.security_content_obj.search.find(nes_field + ' ') != -1): - nes_fields_matches.append(nes_field) - - self.security_content_obj.deployment.notable.nes_fields = nes_fields_matches + if self.security_content_obj: + nes_fields_matches = [] + if self.security_content_obj.deployment: + if self.security_content_obj.deployment.notable: + for nes_field in self.security_content_obj.deployment.notable.nes_fields: + if (self.security_content_obj.search.find(nes_field + ' ') != -1): + nes_fields_matches.append(nes_field) + + self.security_content_obj.deployment.notable.nes_fields = nes_fields_matches def addMappings(self) -> None: - keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist'] - mappings = {} - for key in keys: - if key == 'mitre_attack': - if getattr(self.security_content_obj.tags, 'mitre_attack_id'): - mappings[key] = getattr(self.security_content_obj.tags, 'mitre_attack_id') - elif getattr(self.security_content_obj.tags, key): - mappings[key] = getattr(self.security_content_obj.tags, key) - self.security_content_obj.mappings = mappings + if self.security_content_obj: + keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist'] + mappings = {} + for key in keys: + if key == 'mitre_attack': + if getattr(self.security_content_obj.tags, 'mitre_attack_id'): + mappings[key] = getattr(self.security_content_obj.tags, 'mitre_attack_id') + elif getattr(self.security_content_obj.tags, key): + mappings[key] = getattr(self.security_content_obj.tags, key) + self.security_content_obj.mappings = mappings def addAnnotations(self) -> None: - annotations = {} - annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', - 'analytic_story', 'observable', 'context', 'impact', 'confidence', 'cve'] - for key in annotation_keys: - if key == 'mitre_attack': - if getattr(self.security_content_obj.tags, 'mitre_attack_id'): - annotations[key] = getattr(self.security_content_obj.tags, 'mitre_attack_id') - try: - if getattr(self.security_content_obj.tags, key): - annotations[key] = getattr(self.security_content_obj.tags, key) - except AttributeError as e: - continue - self.security_content_obj.annotations = annotations + if self.security_content_obj: + annotations = {} + annotation_keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist', + 'analytic_story', 'observable', 'context', 'impact', 'confidence', 'cve'] + for key in annotation_keys: + if key == 'mitre_attack': + if getattr(self.security_content_obj.tags, 'mitre_attack_id'): + annotations[key] = getattr(self.security_content_obj.tags, 'mitre_attack_id') + try: + if getattr(self.security_content_obj.tags, key): + annotations[key] = getattr(self.security_content_obj.tags, key) + except AttributeError as e: + continue + self.security_content_obj.annotations = annotations def addPlaybook(self, playbooks: list) -> None: - matched_playbooks = [] - for playbook in playbooks: - if playbook.tags.detections: - for detection in playbook.tags.detections: - if detection == self.security_content_obj.name: - matched_playbooks.append(playbook) + if self.security_content_obj: + matched_playbooks = [] + for playbook in playbooks: + if playbook.tags.detections: + for detection in playbook.tags.detections: + if detection == self.security_content_obj.name: + matched_playbooks.append(playbook) - self.security_content_obj.playbooks = matched_playbooks + self.security_content_obj.playbooks = matched_playbooks def addBaseline(self, baselines: list) -> None: - matched_baselines = [] - for baseline in baselines: - for detection in baseline.tags.detections: - if detection == self.security_content_obj.name: - matched_baselines.append(baseline) + if self.security_content_obj: + matched_baselines = [] + for baseline in baselines: + for detection in baseline.tags.detections: + if detection == self.security_content_obj.name: + matched_baselines.append(baseline) - self.security_content_obj.baselines = matched_baselines + self.security_content_obj.baselines = matched_baselines def addUnitTest(self, tests: list) -> None: - for test in tests: - if test.tests[0].name == self.security_content_obj.name: - self.security_content_obj.test = test - return + if self.security_content_obj: + for test in tests: + if test.tests[0].name == self.security_content_obj.name: + self.security_content_obj.test = test + return def addMitreAttackEnrichment(self, attack_enrichment: dict) -> None: - if attack_enrichment: - if self.security_content_obj.tags.mitre_attack_id: - self.security_content_obj.tags.mitre_attack_enrichments = [] - for mitre_attack_id in self.security_content_obj.tags.mitre_attack_id: - if mitre_attack_id in attack_enrichment: - mitre_attack_enrichment = MitreAttackEnrichment( - mitre_attack_id = mitre_attack_id, - mitre_attack_technique = attack_enrichment[mitre_attack_id]["technique"], - mitre_attack_tactics = sorted(attack_enrichment[mitre_attack_id]["tactics"]), - mitre_attack_groups = sorted(attack_enrichment[mitre_attack_id]["groups"]) - ) - self.security_content_obj.tags.mitre_attack_enrichments.append(mitre_attack_enrichment) - else: - raise ValueError("mitre_attack_id " + mitre_attack_id + " doesn't exist for detecction " + self.security_content_obj.name) + if self.security_content_obj: + if attack_enrichment: + if self.security_content_obj.tags.mitre_attack_id: + self.security_content_obj.tags.mitre_attack_enrichments = [] + for mitre_attack_id in self.security_content_obj.tags.mitre_attack_id: + if mitre_attack_id in attack_enrichment: + mitre_attack_enrichment = MitreAttackEnrichment( + mitre_attack_id = mitre_attack_id, + mitre_attack_technique = attack_enrichment[mitre_attack_id]["technique"], + mitre_attack_tactics = sorted(attack_enrichment[mitre_attack_id]["tactics"]), + mitre_attack_groups = sorted(attack_enrichment[mitre_attack_id]["groups"]) + ) + self.security_content_obj.tags.mitre_attack_enrichments.append(mitre_attack_enrichment) + else: + raise ValueError("mitre_attack_id " + mitre_attack_id + " doesn't exist for detecction " + self.security_content_obj.name) def addMacros(self, macros: list) -> None: - macros_found = re.findall(r'`([^\s]+)`', self.security_content_obj.search) - macros_filtered = set() - self.security_content_obj.macros = [] + if self.security_content_obj: + macros_found = re.findall(r'`([^\s]+)`', self.security_content_obj.search) + macros_filtered = set() + self.security_content_obj.macros = [] - for macro in macros_found: - if not '_filter' in macro and not 'drop_dm_object_name' in macro: - start = macro.find('(') - if start != -1: - macros_filtered.add(macro[:start]) - else: - macros_filtered.add(macro) + for macro in macros_found: + if not '_filter' in macro and not 'drop_dm_object_name' in macro: + start = macro.find('(') + if start != -1: + macros_filtered.add(macro[:start]) + else: + macros_filtered.add(macro) - for macro_name in macros_filtered: - for macro in macros: - if macro_name == macro.name: - self.security_content_obj.macros.append(macro) + for macro_name in macros_filtered: + for macro in macros: + if macro_name == macro.name: + self.security_content_obj.macros.append(macro) - name = self.security_content_obj.name.replace(' ', '_').replace('-', '_').replace('.', '_').replace('/', '_').lower() + '_filter' - macro = Macro(name=name, definition='search *', description='Update this macro to limit the output results to filter out false positives.') - - self.security_content_obj.macros.append(macro) + name = self.security_content_obj.name.replace(' ', '_').replace('-', '_').replace('.', '_').replace('/', '_').lower() + '_filter' + macro = Macro(name=name, definition='search *', description='Update this macro to limit the output results to filter out false positives.') + + self.security_content_obj.macros.append(macro) def addLookups(self, lookups: list) -> None: - lookups_found = re.findall(r'lookup (?:update=true)?(?:append=t)?\s*([^\s]*)', self.security_content_obj.search) - self.security_content_obj.lookups = [] - for lookup_name in lookups_found: - for lookup in lookups: - if lookup.name == lookup_name: - self.security_content_obj.lookups.append(lookup) + if self.security_content_obj: + lookups_found = re.findall(r'lookup (?:update=true)?(?:append=t)?\s*([^\s]*)', self.security_content_obj.search) + self.security_content_obj.lookups = [] + for lookup_name in lookups_found: + for lookup in lookups: + if lookup.name == lookup_name: + self.security_content_obj.lookups.append(lookup) def addCve(self) -> None: - self.security_content_obj.cve_enrichment = [] - if self.security_content_obj.tags.cve: - for cve in self.security_content_obj.tags.cve: - self.security_content_obj.cve_enrichment.append(CveEnrichment.enrich_cve(cve)) + if self.security_content_obj: + self.security_content_obj.cve_enrichment = [] + if self.security_content_obj.tags.cve: + for cve in self.security_content_obj.tags.cve: + self.security_content_obj.cve_enrichment.append(CveEnrichment.enrich_cve(cve)) def reset(self) -> None: diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py index eb448bcf38..f94eca3be6 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_director.py @@ -59,10 +59,10 @@ class SecurityContentDirector(Director): builder.setObject(os.path.join(os.path.dirname(__file__), path), SecurityContentType.macros) - def constructPlaybook(self, builder: PlaybookBuilder, path: str, detections: list) -> None: + def constructPlaybook(self, builder: PlaybookBuilder, path: str) -> None: builder.reset() builder.setObject(os.path.join(os.path.dirname(__file__), path)) - builder.addDetections(detections) + builder.addDetections() def constructTest(self, builder: BasicBuilder, path: str) -> None: diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_playbook_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_playbook_builder.py index a827d1c19e..59edc3dd21 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_playbook_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_playbook_builder.py @@ -1,7 +1,9 @@ import sys +import os from pydantic import ValidationError +from pathlib import Path from bin.contentctl_project.contentctl_core.application.builder.playbook_builder import PlaybookBuilder from bin.contentctl_project.contentctl_core.domain.entities.playbook import Playbook @@ -22,13 +24,16 @@ class SecurityContentPlaybookBuilder(PlaybookBuilder): sys.exit(1) - def addDetections(self, detections : list) -> None: - if detections: - if self.playbook.tags.detections: - self.playbook.tags.detection_objects = [] - for detection in detections: - if detection.name in self.playbook.tags.detections: - self.playbook.tags.detection_objects.append(detection) + def addDetections(self) -> None: + if self.playbook.tags.detections: + self.playbook.tags.detection_objects = [] + for detection in self.playbook.tags.detections: + detection_object = { + "name": detection, + "lowercase_name": self.convertNameToFileName(detection), + "path": self.findDetectionPath(detection) + } + self.playbook.tags.detection_objects.append(detection_object) def reset(self) -> None: @@ -36,4 +41,22 @@ class SecurityContentPlaybookBuilder(PlaybookBuilder): def getObject(self) -> Playbook: - return self.playbook \ No newline at end of file + return self.playbook + + + def convertNameToFileName(self, name: str): + file_name = name \ + .replace(' ', '_') \ + .replace('-','_') \ + .replace('.','_') \ + .replace('/','_') \ + .lower() + return file_name + + + def findDetectionPath(self, detection_name: str) -> str: + for path in Path(os.path.join(os.path.dirname(__file__), '../../../../detections')).rglob(self.convertNameToFileName(detection_name) + '.yml'): + normalized_path = os.path.normpath(path) + path_components = normalized_path.split(os.sep) + value_index = path_components.index('detections') + return "/".join(path_components[value_index:]) \ No newline at end of file diff --git a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py index ea9adc4375..1518b69f31 100644 --- a/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/builder/security_content_story_builder.py @@ -37,19 +37,20 @@ class SecurityContentStoryBuilder(StoryBuilder): kill_chain_phases = set() for detection in detections: - for detection_analytic_story in detection.tags.analytic_story: - if detection_analytic_story == self.story.name: - matched_detection_names.append(str('ESCU - ' + detection.name + ' - Rule')) - matched_detections.append(detection) - datamodels.update(detection.datamodel) - if detection.tags.kill_chain_phases: - kill_chain_phases.update(detection.tags.kill_chain_phases) + if detection: + for detection_analytic_story in detection.tags.analytic_story: + if detection_analytic_story == self.story.name: + matched_detection_names.append(str('ESCU - ' + detection.name + ' - Rule')) + matched_detections.append(detection) + datamodels.update(detection.datamodel) + if detection.tags.kill_chain_phases: + kill_chain_phases.update(detection.tags.kill_chain_phases) - if detection.tags.mitre_attack_enrichments: - for attack_enrichment in detection.tags.mitre_attack_enrichments: - mitre_attack_tactics.update(attack_enrichment.mitre_attack_tactics) - if attack_enrichment.mitre_attack_id not in [attack.mitre_attack_id for attack in mitre_attack_enrichments]: - mitre_attack_enrichments.append(attack_enrichment) + if detection.tags.mitre_attack_enrichments: + for attack_enrichment in detection.tags.mitre_attack_enrichments: + mitre_attack_tactics.update(attack_enrichment.mitre_attack_tactics) + if attack_enrichment.mitre_attack_id not in [attack.mitre_attack_id for attack in mitre_attack_enrichments]: + mitre_attack_enrichments.append(attack_enrichment) self.story.detection_names = matched_detection_names self.story.detections = matched_detections diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json index a385eb12d7..540702941a 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json @@ -364,6 +364,13 @@ ], "product": [ "Splunk SOAR" + ], + "detection_objects": [ + { + "name": "Attempted Credential Dump From Registry via Reg exe", + "lowercase_name": "attempted_credential_dump_from_registry_via_reg_exe", + "path": "detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml" + } ] } } diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_pages/paybooks.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_pages/paybooks.md index e8802735ef..e3ea0882b0 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_pages/paybooks.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_pages/paybooks.md @@ -10,4 +10,4 @@ sidebar: | Name | Detections | Type | | --------| ---------- | ----------- | -| [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Attempted Credential Dump From Registry via Reg exe](/detection/attempted_credential_dump_from_registry_via_reg_exe/)| Response | +| [Ransomware Investigate and Contain](/playbooks/ransomware_investigate_and_contain/)|[Attempted Credential Dump From Registry via Reg exe]((/detection/attempted_credential_dump_from_registry_via_reg_exe/)| Response | diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_playbooks/ransomware_investigate_and_contain.md b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_playbooks/ransomware_investigate_and_contain.md index d0168d5128..62159cab06 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_playbooks/ransomware_investigate_and_contain.md +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_playbooks/ransomware_investigate_and_contain.md @@ -30,7 +30,7 @@ This playbook investigates and contains ransomware detected on endpoints. #### Associated Detections -* [Attempted Credential Dump From Registry via Reg exe](//attempted_credential_dump_from_registry_via_reg_exe/) +* [Attempted Credential Dump From Registry via Reg exe](/detection/attempted_credential_dump_from_registry_via_reg_exe/) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_attack_nav_adapter.py b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_attack_nav_adapter.py index 24da08408e..67a9674d99 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_attack_nav_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_attack_nav_adapter.py @@ -48,7 +48,7 @@ def test_svg_writer(): playbook_builder = SecurityContentPlaybookBuilder() director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), - '../builder/test_data/playbook/example_playbook.yml'), []) + '../builder/test_data/playbook/example_playbook.yml')) playbook = playbook_builder.getObject() detection_builder = SecurityContentDetectionBuilder() diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_conf_adapter.py b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_conf_adapter.py index 8f0dcb185f..2e40aeb9a5 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_conf_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_conf_adapter.py @@ -52,7 +52,7 @@ def test_write_conf_files(patch_datetime_now): playbook_builder = SecurityContentPlaybookBuilder() director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), - '../builder/test_data/playbook/example_playbook.yml'), []) + '../builder/test_data/playbook/example_playbook.yml')) playbook = playbook_builder.getObject() baseline_builder = SecurityContentBaselineBuilder() diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py index 500a15135c..81aecc6bff 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_json_adapter.py @@ -143,7 +143,7 @@ def test_write_stories(): playbook_builder = SecurityContentPlaybookBuilder() director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), - '../builder/test_data/playbook/example_playbook.yml'), []) + '../builder/test_data/playbook/example_playbook.yml')) playbook = playbook_builder.getObject() baseline_builder = SecurityContentBaselineBuilder() diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py index b7721be43b..00e84957e0 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_md_adapter.py @@ -48,7 +48,7 @@ def test_md_writer(): playbook_builder = SecurityContentPlaybookBuilder() director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), - '../builder/test_data/playbook/example_playbook.yml'), []) + '../builder/test_data/playbook/example_playbook.yml')) playbook = playbook_builder.getObject() detection_builder = SecurityContentDetectionBuilder() @@ -64,7 +64,7 @@ def test_md_writer(): playbook_builder = SecurityContentPlaybookBuilder() director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), - '../builder/test_data/playbook/example_playbook.yml'), [detection]) + '../builder/test_data/playbook/example_playbook.yml')) playbook = playbook_builder.getObject() investigation_builder = SecurityContentInvestigationBuilder() diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_svg_adapter.py b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_svg_adapter.py index e7ba67b44e..b572d55df9 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_svg_adapter.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/test_obj_to_svg_adapter.py @@ -48,7 +48,7 @@ def test_svg_writer(): playbook_builder = SecurityContentPlaybookBuilder() director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), - '../builder/test_data/playbook/example_playbook.yml'), []) + '../builder/test_data/playbook/example_playbook.yml')) playbook = playbook_builder.getObject() detection_builder = SecurityContentDetectionBuilder() diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py index 5a16caceda..60a40bed79 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py @@ -50,7 +50,7 @@ def test_construct_playbooks(): director = SecurityContentDirector() playbook_builder = SecurityContentPlaybookBuilder() director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), - 'test_data/playbook/example_playbook.yml'), []) + 'test_data/playbook/example_playbook.yml')) playbook = playbook_builder.getObject() assert playbook.name == "Ransomware Investigate and Contain" @@ -120,7 +120,7 @@ def test_construct_detections(): playbook_builder = SecurityContentPlaybookBuilder() director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), - 'test_data/playbook/example_playbook.yml'), []) + 'test_data/playbook/example_playbook.yml')) playbook = playbook_builder.getObject() baseline_builder = SecurityContentBaselineBuilder() @@ -188,7 +188,7 @@ def test_construct_stories(): playbook_builder = SecurityContentPlaybookBuilder() director.constructPlaybook(playbook_builder, os.path.join(os.path.dirname(__file__), - 'test_data/playbook/example_playbook.yml'), []) + 'test_data/playbook/example_playbook.yml')) playbook = playbook_builder.getObject() baseline_builder = SecurityContentBaselineBuilder() diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_playbook_builder.py b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_playbook_builder.py index 7ccfaf5ef9..3169f37ae8 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_playbook_builder.py +++ b/bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_playbook_builder.py @@ -14,15 +14,11 @@ def test_read_playbook(): def test_enrich_detections(): - security_content_builder = SecurityContentDetectionBuilder() - security_content_builder.setObject(os.path.join(os.path.dirname(__file__), - 'test_data/detection/valid.yml')) - detection = security_content_builder.getObject() playbook_builder = SecurityContentPlaybookBuilder() playbook_builder.setObject(os.path.join(os.path.dirname(__file__), 'test_data/playbook/example_playbook.yml')) - playbook_builder.addDetections([detection]) + playbook_builder.addDetections() playbook = playbook_builder.getObject() - assert playbook.tags.detection_objects[0].name == "Attempted Credential Dump From Registry via Reg exe" \ No newline at end of file + assert playbook.tags.detection_objects[0]['path'] == "detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml" \ No newline at end of file diff --git a/contentctl.py b/contentctl.py index a250e158f1..46dfda7cca 100644 --- a/contentctl.py +++ b/contentctl.py @@ -33,7 +33,7 @@ from bin.contentctl_project.contentctl_infrastructure.builder.attack_enrichment from bin.contentctl_project.contentctl_core.domain.entities.enums.enums import SecurityContentType -def init(args): +def init(): print(""" Running Splunk Security Content Control Tool (contentctl) @@ -65,16 +65,6 @@ starting program loaded for TIE Fighter... """) - # parse config - security_content_path = os.path(args.path).resolve() - if security_content_path.is_dir(): - print("contentctl is reading from path {0}".format( - security_content_path)) - else: - print("ERROR: contentctl failed to find security_content project") - sys.exit(1) - return str(security_content_path) - def content_changer(args) -> None: factory_input_dto = ObjectFactoryInputDto( @@ -155,8 +145,8 @@ def validate(args) -> None: print("ERROR: missing parameter -p/--product .") sys.exit(1) - if args.product not in ['ESCU', 'SSA']: - print("ERROR: invalid product. valid products are ESCU, SSA or API.") + if args.product not in ['ESCU', 'SSA', 'all']: + print("ERROR: invalid product. valid products are all, ESCU or SSA.") sys.exit(1) factory_input_dto = FactoryInputDto( @@ -178,21 +168,24 @@ def validate(args) -> None: SecurityContentDirector() ) - if args.product == "ESCU": + if args.product == "ESCU" or args.product == "all": validate_input_dto = ValidateInputDto( factory_input_dto, ba_factory_input_dto, SecurityContentProduct.ESCU ) - elif args.product == "SSA": + validate = Validate() + validate.execute(validate_input_dto) + + if args.product == "SSA" or args.product == "all": validate_input_dto = ValidateInputDto( factory_input_dto, ba_factory_input_dto, SecurityContentProduct.SSA ) + validate = Validate() + validate.execute(validate_input_dto) - validate = Validate() - validate.execute(validate_input_dto) def doc_gen(args) -> None: @@ -258,6 +251,8 @@ def reporting(args) -> None: def main(args): + init() + # grab arguments parser = argparse.ArgumentParser( description="Use `contentctl.py action -h` to get help with any Splunk Security Content action") @@ -281,8 +276,8 @@ def main(args): # help="Generates an example content UPDATE on the fields that need updating. Use `git status` to see what specific files are added. Skips new content wizard prompts.") # new_parser.set_defaults(func=new) - validate_parser.add_argument("-pr", "--product", required=True, type=str, - help="Type of package to create, choose between `ESCU` or `SSA`.") + validate_parser.add_argument("-pr", "--product", required=True, type=str, default='all', + help="Type of package to create, choose between all, `ESCU` or `SSA`.") validate_parser.set_defaults(func=validate, epilog=""" Validates security manifest for correctness, adhering to spec and other common items.""") diff --git a/dist/escu/default/analyticstories.conf b/dist/escu/default/analyticstories.conf index 94c41c1730..aa2e74ebc8 100644 --- a/dist/escu/default/analyticstories.conf +++ b/dist/escu/default/analyticstories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:01 UTC +# On Date: 2022-03-21T07:44:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -1217,7 +1217,7 @@ annotations = {"kill_chain_phases": ["Exploitation"]} known_false_positives = This search can give false positives as there might be inherent issues with authentications and permissions at cluster. providing_technologies = [] -[savedsearch://ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule] +[savedsearch://ESCU - Kubernetes Azure active service accounts by pod namespace - Rule] type = detection asset_type = Azure AKS Kubernetes cluster confidence = medium @@ -1357,16 +1357,6 @@ annotations = {"kill_chain_phases": ["Exploitation"]} known_false_positives = Kubectl calls are not malicious by nature. However source IP, source user, user agent, object path, and authorization context can reveal potential malicious activity, specially anonymous suspicious IPs and sensitive objects such as configmaps or secrets providing_technologies = [] -[savedsearch://ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule] -type = detection -asset_type = Endpoint -confidence = medium -explanation = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command -how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} -known_false_positives = Legitimate process can have this combination of command-line options, but it's not common. -providing_technologies = [] - [savedsearch://ESCU - Monitor DNS For Brand Abuse - Rule] type = detection asset_type = Endpoint @@ -1497,6 +1487,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = It's possible for a legitimate file to be created with the same name as one noted in the lookup file. Filenames listed in the lookup file should be unique enough that collisions are rare. Looking at the location of the file and the process responsible for the activity can help determine whether or not the activity is legitimate. providing_technologies = [] +[savedsearch://ESCU - Suspicious Powershell Command-Line Arguments - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command +how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. +annotations = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +known_false_positives = Legitimate process can have this combination of command-line options, but it's not common. +providing_technologies = [] + [savedsearch://ESCU - Suspicious Rundll32 Rename - Rule] type = detection asset_type = Endpoint @@ -3224,6 +3224,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]} known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Excessive distinct processes from Windows Temp - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} +known_false_positives = Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed. +providing_technologies = [] + [savedsearch://ESCU - Excessive File Deletion In WinDefender Folder - Rule] type = detection asset_type = Endpoint @@ -3234,16 +3244,6 @@ annotations = {"cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Exp known_false_positives = Windows Defender AV updates may cause this alert. Please update the filter macros to remove false positives. providing_technologies = [] -[savedsearch://ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule] -type = detection -asset_type = Endpoint -confidence = medium -explanation = This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp. -how_to_implement = To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. -annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} -known_false_positives = Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed. -providing_technologies = [] - [savedsearch://ESCU - Excessive number of service control start as disabled - Rule] type = detection asset_type = Endpoint @@ -4612,32 +4612,6 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.00 known_false_positives = quite minimal false positive expected. providing_technologies = [] -[savedsearch://ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule] -type = detection -asset_type = Endpoint -confidence = medium -explanation = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ -The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ -This detection will only trigger on domain controllers, not on member servers or workstations.\ -The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. -how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. -annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} -known_false_positives = A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems. -providing_technologies = [] - -[savedsearch://ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule] -type = detection -asset_type = Endpoint -confidence = medium -explanation = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ -The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ -This detection will only trigger on domain controllers, not on member servers or workstations.\ -The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. -how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. -annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} -known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. -providing_technologies = [] - [savedsearch://ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule] type = detection asset_type = Endpoint @@ -4651,19 +4625,6 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.00 known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners and missconfigured systems. If this detection triggers on a host other than a Domain Controller, the behavior could represent a password spraying attack against the host's local accounts. providing_technologies = [] -[savedsearch://ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule] -type = detection -asset_type = Endpoint -confidence = medium -explanation = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ -The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ -This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ -The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. -how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. -annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} -known_false_positives = A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. -providing_technologies = [] - [savedsearch://ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule] type = detection asset_type = Endpoint @@ -5191,7 +5152,7 @@ annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1069" known_false_positives = False positives may be present. Tune as needed. providing_technologies = [] -[savedsearch://ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule] +[savedsearch://ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule] type = detection asset_type = Endpoint confidence = medium @@ -6891,6 +6852,19 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_att known_false_positives = It is unusual to turn this feature off a Windows system since it is a default security control, although it is not rare for some policies to disable it. Although no false positives have been identified, use the provided filter macro to tune the search. providing_technologies = [] +[savedsearch://ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} +known_false_positives = A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems. +providing_technologies = [] + [savedsearch://ESCU - Windows DiskCryptor Usage - Rule] type = detection asset_type = Endpoint @@ -7078,6 +7052,19 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.00 known_false_positives = Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements. providing_technologies = [] +[savedsearch://ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} +known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. +providing_technologies = [] + [savedsearch://ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule] type = detection asset_type = Endpoint @@ -7262,6 +7249,19 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543", known_false_positives = Administrators may start Windows Services on remote systems, but this activity is usually limited to a small set of hosts or users. providing_technologies = [] +[savedsearch://ESCU - Windows Users Authenticate Using Explicit Credentials - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. +how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} +known_false_positives = A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. +providing_technologies = [] + [savedsearch://ESCU - Windows WMI Process Call Create - Rule] type = detection asset_type = Endpoint @@ -7958,7 +7958,7 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation", "Comman known_false_positives = At this stage, there are no known false positives. During testing, no process events refering the com.apple.loginwindow.plist files were observed during normal operation of re-opening applications on reboot. Therefore, it can be asumed that any occurences of this in the process events would be worth investigating. In the event that the legitimate modification by the system of these files is in fact logged to the process log, then the process_name of that process can be added to an allow list. providing_technologies = [] -[savedsearch://ESCU - Microsoft Exchange Mailbox Replication service writing Active Server Pages - Rule] +[savedsearch://ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule] type = detection asset_type = Endpoint confidence = medium @@ -8613,7 +8613,7 @@ version = 1 references = ["https://en.wikipedia.org/wiki/Kerberos_(protocol)", "https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9", "https://m0chan.github.io/2019/07/31/How-To-Attack-Kerberos-101.html", "https://stealthbits.com/blog/cracking-active-directory-passwords-with-as-rep-roasting/", "https://attack.mitre.org/techniques/T1558/003/", "https://attack.mitre.org/techniques/T1550/003/", "https://attack.mitre.org/techniques/T1558/004/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}] spec_version = 3 -searches = ["ESCU - Disabled Kerberos Pre-Authentication Discovery With Get-ADUser - Rule", "ESCU - Disabled Kerberos Pre-Authentication Discovery With PowerView - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled in UserAccountControl - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled with PowerShell - Rule", "ESCU - Mimikatz PassTheTicket CommandLine Parameters - Rule", "ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Rubeus Command Line Parameters - Rule", "ESCU - Rubeus Kerberos Ticket Exports Through Winlogon Access - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - Unusual Number of Kerberos Service Tickets Requested - Rule"] +searches = ["ESCU - Disabled Kerberos Pre-Authentication Discovery With Get-ADUser - Rule", "ESCU - Disabled Kerberos Pre-Authentication Discovery With PowerView - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled in UserAccountControl - Rule", "ESCU - Kerberos Pre-Authentication Flag Disabled with PowerShell - Rule", "ESCU - Mimikatz PassTheTicket CommandLine Parameters - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Rubeus Command Line Parameters - Rule", "ESCU - Rubeus Kerberos Ticket Exports Through Winlogon Access - Rule", "ESCU - ServicePrincipalNames Discovery with PowerShell - Rule", "ESCU - ServicePrincipalNames Discovery with SetSPN - Rule", "ESCU - Unusual Number of Kerberos Service Tickets Requested - Rule", "ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule", "ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule"] description = Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments. narrative = Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access to services and network resources based on their privilege level. Kerberos is the default authentication protocol used on Windows Active Directory networks since the introduction of Windows Server 2003. With Kerberos being the backbone of Windows authentication, it is commonly abused by adversaries across the different phases of a breach including initial access, privilege escalation, defense evasion, credential access, lateral movement, etc.\ This Analytic Story groups detection use cases in which the Kerberos protocol is abused. Defenders can leverage these analytics to detect and hunt for adversaries engaging in Kerberos based attacks. @@ -8639,7 +8639,7 @@ version = 1 references = ["https://attack.mitre.org/techniques/T1110/003/", "https://www.microsoft.com/security/blog/2020/04/23/protecting-organization-password-spray-attacks/", "https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/dn452415(v=ws.11)"] maintainers = [{"company": "Splunk", "email": "-", "name": "Mauricio Velazco"}] spec_version = 3 -searches = ["ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule"] +searches = ["ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule", "ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule", "ESCU - Multiple Users Failing To Authenticate From Process - Rule", "ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule", "ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule", "ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule", "ESCU - Windows Users Authenticate Using Explicit Credentials - Rule"] description = Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments. narrative = In a password spraying attack, adversaries leverage one or a small list of commonly used / popular passwords against a large volume of usernames to acquire valid account credentials. Unlike a Brute Force attack that targets a specific user or small group of users with a large number of passwords, password spraying follows the opposite aproach and increases the chances of obtaining valid credentials while avoiding account lockouts. This allows adversaries to remain undetected if the target organization does not have the proper monitoring and detection controls in place.\ Password Spraying can be leveraged by adversaries across different stages in an attack. It can be used to obtain an iniial access to an environment but can also be used to escalate privileges when access has been already achieved. In some scenarios, this technique capitalizes on a security policy most organizations implement, password rotation. As enterprise users change their passwords, it is possible some pick predictable, seasonal passwords such as `$CompanyNameWinter`, `Summer2021`, etc.\ @@ -8983,7 +8983,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Kubernetes AWS detect most active service accounts by pod - Rule", "ESCU - Kubernetes AWS detect RBAC authorization by account - Rule", "ESCU - Kubernetes AWS detect sensitive role access - Rule", "ESCU - Kubernetes Azure active service accounts by pod namespace - Rule", "ESCU - Kubernetes Azure detect RBAC authorization by account - Rule", "ESCU - Kubernetes Azure detect sensitive role access - Rule", "ESCU - Kubernetes GCP detect RBAC authorizations by account - Rule", "ESCU - Kubernetes GCP detect most active service accounts by pod - Rule", "ESCU - Kubernetes GCP detect sensitive role access - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive roles within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes role activities @@ -9395,14 +9395,14 @@ narrative = Privilege escalation is a "land-and-expand" technique, wherein an ad [analytic_story://Living Off The Land] category = Adversary Tactics -last_updated = 2022-02-17 -version = 1 +last_updated = 2022-03-16 +version = 2 references = ["https://lolbas-project.github.io/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Lou Stella"}] spec_version = 3 -searches = ["ESCU - Eventvwr UAC Bypass - Rule", "ESCU - MacOS LOLbin - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule", "ESCU - WSReset UAC Bypass - Rule"] -description = Leverage searches that allow you to search for the presence of an attacker leveraging existing tooling within your environment. -narrative = Living Off The Land refers to an attacker methodology of using software already installed on their target host to achieve their goals. Many utilities that ship with Windows can be used to achieve various goals, with reduced chances of detection by an antivirus software. +searches = ["ESCU - BITS Job Persistence - Rule", "ESCU - BITSAdmin Download File - Rule", "ESCU - CertUtil Download With URLCache and Split Arguments - Rule", "ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule", "ESCU - Certutil exe certificate extraction - Rule", "ESCU - CertUtil With Decode Argument - Rule", "ESCU - CMD Carry Out String Command Parameter - Rule", "ESCU - Control Loading from World Writable Directory - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule", "ESCU - Detect Regsvr32 Application Control Bypass - Rule", "ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule", "ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule", "ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Disable Schedule Task - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Esentutl SAM Copy - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - MacOS LOLbin - Rule", "ESCU - Mmc LOLBAS Execution Process Spawn - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule", "ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Rundll32 Control RunDLL Hunt - Rule", "ESCU - Rundll32 Control RunDLL World Writable Directory - Rule", "ESCU - Rundll32 Create Remote Thread To A Process - Rule", "ESCU - Rundll32 CreateRemoteThread In Browser - Rule", "ESCU - Rundll32 DNSQuery - Rule", "ESCU - Rundll32 Process Creating Exe Dll Files - Rule", "ESCU - Rundll32 Shimcache Flush - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Scheduled Task Initiation on Remote Endpoint - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Services LOLBAS Execution Process Spawn - Rule", "ESCU - Suspicious IcedID Rundll32 Cmdline - Rule", "ESCU - Suspicious microsoft workflow compiler rename - Rule", "ESCU - Suspicious microsoft workflow compiler usage - Rule", "ESCU - Suspicious msbuild path - Rule", "ESCU - Suspicious MSBuild Rename - Rule", "ESCU - Suspicious MSBuild Spawn - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule", "ESCU - Suspicious Rundll32 dllregisterserver - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Svchost LOLBAS Execution Process Spawn - Rule", "ESCU - Windows Diskshadow Proxy Execution - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows InstallUtil Remote Network Connection - Rule", "ESCU - Windows InstallUtil Uninstall Option - Rule", "ESCU - Windows InstallUtil Uninstall Option with Network - Rule", "ESCU - Windows InstallUtil URL in Command Line - Rule", "ESCU - WSReset UAC Bypass - Rule"] +description = Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment. +narrative = Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior. [analytic_story://Log4Shell CVE-2021-44228] category = Adversary Tactics @@ -9422,7 +9422,7 @@ version = 5 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Suspicious Powershell Command-Line Arguments - Rule", "ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - Possible Lateral Movement PowerShell Spawn - Rule", "ESCU - PowerShell 4104 Hunting - Rule", "ESCU - PowerShell - Connect To Internet With Hidden Window - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope. \ The following factors may assist you in determining whether the event is malicious: \ @@ -9457,7 +9457,7 @@ version = 1 references = ["https://www.offensive-security.com/metasploit-unleashed/about-meterpreter/", "https://doubleoctopus.com/security-wiki/threats-and-tools/meterpreter/", "https://www.rapid7.com/products/metasploit/"] maintainers = [{"company": "no", "email": "-", "name": "Michael Hart"}] spec_version = 3 -searches = ["ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule", "ESCU - Excessive number of taskhost processes - Rule"] +searches = ["ESCU - Excessive distinct processes from Windows Temp - Rule", "ESCU - Excessive number of taskhost processes - Rule"] description = Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions. narrative = This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Meterpreter. Meterpreter is a Metasploit payload for remote execution that leverages DLL injection to make it extremely difficult to detect. Since the software runs in memory, no new processes are created upon injection. It also leverages encrypted communication channels.\ Meterpreter enables the operator to remotely run commands on the target machine, upload payloads, download files, dump password hashes, and much more. It is difficult to determine from the forensic evidence what actions the operator performed. Splunk Research, however, has observed anomalous behaviors on the compromised hosts that seem to only appear when Meterpreter is executing various commands. With that, we have written new detections targeted to these detections.\ @@ -9630,7 +9630,7 @@ version = 1 references = ["https://y4y.space/2021/08/12/my-steps-of-reproducing-proxyshell/", "https://www.zerodayinitiative.com/blog/2021/8/17/from-pwn2own-2021-a-new-attack-surface-on-microsoft-exchange-proxyshell", "https://www.youtube.com/watch?v=FC6iHw258RI", "https://www.huntress.com/blog/rapid-response-microsoft-exchange-servers-still-vulnerable-to-proxyshell-exploit#what-should-you-do", "https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-ProxyLogon-Is-Just-The-Tip-Of-The-Iceberg-A-New-Attack-Surface-On-Microsoft-Exchange-Server.pdf"] maintainers = [{"company": "Teoderick Contreras, Mauricio Velazco, Splunk", "email": "-", "name": "Michael Haag"}] spec_version = 3 -searches = ["ESCU - Detect Exchange Web Shell - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Exchange PowerShell Abuse via SSRF - Rule", "ESCU - Exchange PowerShell Module Usage - Rule", "ESCU - Microsoft Exchange Mailbox Replication service writing Active Server Pages - Rule"] +searches = ["ESCU - Detect Exchange Web Shell - Rule", "ESCU - W3WP Spawning Shell - Rule", "ESCU - Exchange PowerShell Abuse via SSRF - Rule", "ESCU - Exchange PowerShell Module Usage - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule"] description = ProxyShell is a chain of exploits targeting on-premise Microsoft Exchange Server - CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. narrative = During Pwn2Own April 2021, a security researcher demonstrated an attack chain targeting on-premise Microsoft Exchange Server. August 5th, the same researcher publicly released further details and demonstrated the attack chain. CVE-2021-34473 Pre-auth path confusion leads to ACL Bypass (Patched in April by KB5001779) CVE-2021-34523 - Elevation of privilege on Exchange PowerShell backend (Patched in April by KB5001779) . CVE-2021-31207 - Post-auth Arbitrary-File-Write leads to RCE (Patched in May by KB5003435) Upon successful exploitation, the remote attacker will have SYSTEM privileges on the Exchange Server. In addition to remote access/execution, the adversary may be able to run Exchange PowerShell Cmdlets to perform further actions. @@ -9641,7 +9641,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - Microsoft Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"] +searches = ["ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - 7zip CommandLine To SMB Share Path - Rule", "ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Fsutil Zeroing File - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Execute COM Object - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - UAC Bypass With Colorui COM Object - Rule", "ESCU - Uninstall App Using MsiExec - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - Windows Disable Change Password Through Registry - Rule", "ESCU - Windows Disable Lock Workstation Feature Through Registry - Rule", "ESCU - Windows Disable LogOff Button Through Registry - Rule", "ESCU - Windows Disable Memory Crash Dump - Rule", "ESCU - Windows Disable Shutdown Button Through Registry - Rule", "ESCU - Windows Disable Windows Group Policy Features Through Registry - Rule", "ESCU - Windows DiskCryptor Usage - Rule", "ESCU - Windows DotNet Binary in Non Standard Path - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Windows Hide Notification Features Through Registry - Rule", "ESCU - Windows InstallUtil in Non Standard Path - Rule", "ESCU - Windows NirSoft AdvancedRun - Rule", "ESCU - Windows Raccine Scheduled Task Deletion - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task", "ESCU - Rundll32 LockWorkStation - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 88b3351cdb..79164e8021 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:01 UTC +# On Date: 2022-03-21T07:44:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml index fdc7394fc2..8c6fee6165 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml index 59e838679c..14c9cec4e8 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml index 60be179c8f..5f5b4b9803 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml index f251ff0309..dc910e71a9 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml index bea78aa983..9a8851068d 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml index 52a7c629a8..c9d3e10438 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml index 38c20ddfb4..e308691e8e 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml index b49d69ce50..6fda19dee1 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml index 5e2f032d10..fc4fff7fe5 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml index 62f0e2ffa4..5b2966efd9 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml index 8c233189c9..6702ff82e1 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml index 34cccceca7..70173d6fb8 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml index 21d494518e..b4a52374a9 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml index 2292b887b3..52aec66472 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml index 062717ccd6..81a26c33b4 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml index b8a30e41d2..e243527301 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_dns_server_history_for_a_host___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml index 1eb44562fd..0f9a5a0a44 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_dns_traffic_ratio___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml index 7403578f9a..b0a3d07cca 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml index f11993ba4a..c52d7fc1d3 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml index 00a88c6d42..03dd72ee95 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_email_info___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml index 93a11675ed..4318893e16 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_emails_from_specific_sender___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml index 12541bb8f4..4afc01b14b 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml index 33b24a25d4..1e592ef802 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_history_of_email_sources___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml index 098284a510..6a04d33d0d 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml index 4688eafef7..9b4c01481e 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml index 001a1f6e77..13e9605b54 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_notable_history___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml index 10b3acca27..800f48acf3 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml index d4c9864de2..4f911004dd 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_process_file_activity___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml index c82b13dd2b..e2865244dc 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml index db2ddfd270..a467c85a5c 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_process_information_for_port_activity___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml index d974308d41..e581352281 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_process_responsible_for_the_dns_traffic___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml index f34e621435..61b2c13f56 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml index 49ad101ba9..bf5d89330a 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml index a658bf8bfa..dd6dbf1381 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml index e5b376ab5e..e59e255232 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml index 726f61208e..0a65dbef19 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_failed_logins_for_multiple_destinations___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml index d57e43eacd..4f1ba794dd 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_network_traffic_from_src_ip___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml index 03e0dbdf4b..03d833a610 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml index 7ac3530157..b150a9195c 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_hash_attempts___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml index 7eddced453..81eb984f3e 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_pass_the_ticket_attempts___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml index 3f8ce04788..c764885a64 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_previous_unseen_user___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml index df696b2ab9..f0e38cab50 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_successful_remote_desktop_authentications___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml index bf9d6e7229..d8dcc3802a 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml index 40bd7dc414..444fd538b1 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml index a7842f555b..63d2036594 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_web_posts_from_src___response_task.xml @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:02 UTC +# On Date: 2022-03-21T07:44:44 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index c077c6a26d..e71a9837f1 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:01 UTC +# On Date: 2022-03-21T07:44:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index f34ce212a2..3e60c90ae7 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:01 UTC +# On Date: 2022-03-21T07:44:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -473,7 +473,7 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter] +[kubernetes_azure_active_service_accounts_by_pod_namespace_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -529,10 +529,6 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[malicious_powershell_process___multiple_suspicious_command_line_arguments_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - [monitor_dns_for_brand_abuse_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -585,6 +581,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[suspicious_powershell_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [suspicious_rundll32_rename_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1265,11 +1265,11 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[excessive_file_deletion_in_windefender_folder_filter] +[excessive_distinct_processes_from_windows_temp_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. -[excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter] +[excessive_file_deletion_in_windefender_folder_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1809,22 +1809,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - -[multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - [multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. -[multiple_users_attempting_to_authenticate_using_explicit_credentials_filter] -definition = search * -description = Update this macro to limit the output results to filter out false positives. - [multiple_users_failing_to_authenticate_from_host_using_kerberos_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2025,7 +2013,7 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter] +[powershell_loading_dotnet_into_memory_via_reflection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2693,6 +2681,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[windows_disabled_users_failing_to_authenticate_kerberos_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_diskcryptor_usage_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2761,6 +2753,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[windows_invalid_users_failed_authentication_via_kerberos_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_modify_show_compress_color_and_info_tip_registry_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2833,6 +2829,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[windows_users_authenticate_using_explicit_credentials_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_wmi_process_call_create_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -3101,7 +3101,7 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. -[microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter] +[ms_exchange_mailbox_replication_service_writing_active_server_pages_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 65c2c6b9b8..979b0ec771 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:01 UTC +# On Date: 2022-03-21T07:44:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -4945,7 +4945,7 @@ realtime_schedule = 0 is_visible = false search = `aws_cloudwatchlogs_eks` user.groups{}=system:serviceaccounts responseStatus.status = Failure | table sourceIPs{} user.username userAgent verb responseStatus.status requestURI | `kubernetes_aws_detect_service_accounts_forbidden_failure_access_filter` -[ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule] +[ESCU - Kubernetes Azure active service accounts by pod namespace - Rule] action.escu = 0 action.escu.enabled = 1 description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb @@ -4957,7 +4957,7 @@ action.escu.known_false_positives = Not all service accounts interactions are ma action.escu.creation_date = 2020-05-26 action.escu.modification_date = 2020-05-26 action.escu.confidence = high -action.escu.full_search_name = ESCU - Kubernetes Azure detect most active service accounts by pod namespace - Rule +action.escu.full_search_name = ESCU - Kubernetes Azure active service accounts by pod namespace - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] @@ -4971,7 +4971,7 @@ cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Deprecated - Kubernetes Azure detect most active service accounts by pod namespace - Rule +action.correlationsearch.label = ESCU - Deprecated - Kubernetes Azure active service accounts by pod namespace - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Exploitation"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} schedule_window = auto alert.digest_mode = 1 @@ -4983,7 +4983,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `kubernetes_azure` category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts* OR user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow | table sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace_filter` +search = `kubernetes_azure` category=kube-audit | spath input=properties.log | search user.groups{}=system:serviceaccounts* OR user.username=system.anonymous OR annotations.authorization.k8s.io/decision=allow | table sourceIPs{} user.username userAgent verb responseStatus.reason responseStatus.status properties.pod objectRef.namespace | top sourceIPs{} user.username verb responseStatus.status properties.pod objectRef.namespace |`kubernetes_azure_active_service_accounts_by_pod_namespace_filter` [ESCU - Kubernetes Azure detect RBAC authorization by account - Rule] action.escu = 0 @@ -5505,52 +5505,6 @@ realtime_schedule = 0 is_visible = false search = `google_gcp_pubsub_message` data.protoPayload.requestMetadata.callerSuppliedUserAgent=kubectl* src_user=system:unsecured OR src_user=system:anonymous | table src_ip src_user data.protoPayload.requestMetadata.callerSuppliedUserAgent data.protoPayload.authorizationInfo{}.granted object_path |dedup src_ip src_user |`kubernetes_gcp_detect_suspicious_kubectl_calls_filter` -[ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command -action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command -action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. -action.escu.known_false_positives = Legitimate process can have this combination of command-line options, but it's not common. -action.escu.creation_date = 2021-01-19 -action.escu.modification_date = 2021-01-19 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Malicious PowerShell"] -action.risk = 1 -action.risk.param._risk_message = tbd -action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Deprecated - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} -schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = [] -action.notable.param.rule_description = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command -action.notable.param.rule_title = Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments -action.notable.param.security_domain = endpoint -action.notable.param.severity = high -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* | `malicious_powershell_process___multiple_suspicious_command_line_arguments_filter` - [ESCU - Monitor DNS For Brand Abuse - Rule] action.escu = 0 action.escu.enabled = 1 @@ -6131,6 +6085,52 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count values(Filesystem.action) as action values(Filesystem.file_path) as file_path min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem by Filesystem.file_name Filesystem.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Filesystem)` | `suspicious_writes` | `suspicious_file_write_filter` +[ESCU - Suspicious Powershell Command-Line Arguments - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command +action.escu.mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command +action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be ingesting logs with both the process name and command line from your endpoints. The command-line arguments are mapped to the "process" field in the Endpoint data model. +action.escu.known_false_positives = Legitimate process can have this combination of command-line options, but it's not common. +action.escu.creation_date = 2021-01-19 +action.escu.modification_date = 2021-01-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Suspicious Powershell Command-Line Arguments - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Malicious PowerShell"] +action.risk = 1 +action.risk.param._risk_message = tbd +action.risk.param._risk = [{"threat_object_field": "field", "threat_object_type": "unknown"}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Deprecated - Suspicious Powershell Command-Line Arguments - Rule +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 50, "context": ["Unknown"], "impact": 50, "kill_chain_phases": ["Command \u0026 Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "field", "role": ["Unknown"], "type": "Unknown"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = [] +action.notable.param.rule_description = This search looks for PowerShell processes started with a base64 encoded command-line passed to it, with parameters to modify the execution policy for the process, and those that prevent the display of an interactive prompt to the user. This combination of command-line options is suspicious because it overrides the default PowerShell execution policy, attempts to hide itself from the user, and passes an encoded script to be run on the command-line. Deprecated because almost the same as Malicious PowerShell Process - Encoded Command +action.notable.param.rule_title = Suspicious Powershell Command-Line Arguments +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| search (process=*-EncodedCommand* OR process=*-enc*) process=*-Exec* | `suspicious_powershell_command_line_arguments_filter` + [ESCU - Suspicious Rundll32 Rename - Rule] action.escu = 0 action.escu.enabled = 1 @@ -7611,7 +7611,7 @@ action.escu.full_search_name = ESCU - BITS Job Persistence - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["BITS Jobs"] +action.escu.analytic_story = ["BITS Jobs", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -7622,7 +7622,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - BITS Job Persistence - Rule -action.correlationsearch.annotations = {"analytic_story": ["BITS Jobs"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["BITS Jobs", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -7657,7 +7657,7 @@ action.escu.full_search_name = ESCU - BITSAdmin Download File - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware"] +action.escu.analytic_story = ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -7668,7 +7668,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - BITSAdmin Download File - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197", "T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "BITS Jobs", "DarkSide Ransomware", "Living Off The Land"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197", "T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -7703,7 +7703,7 @@ action.escu.full_search_name = ESCU - CertUtil Download With URLCache and Split action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"] +action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -7714,7 +7714,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CertUtil Download With URLCache and Split Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -7749,7 +7749,7 @@ action.escu.full_search_name = ESCU - CertUtil Download With VerifyCtl and Split action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"] +action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -7760,7 +7760,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -7795,7 +7795,7 @@ action.escu.full_search_name = ESCU - Certutil exe certificate extraction - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"] +action.escu.analytic_story = ["Windows Persistence Techniques", "Cloud Federated Credential Abuse", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -7806,7 +7806,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Certutil exe certificate extraction - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Installation"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Cloud Federated Credential Abuse", "Living Off The Land"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Installation"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -7841,7 +7841,7 @@ action.escu.full_search_name = ESCU - CertUtil With Decode Argument - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Deobfuscate-Decode Files or Information"] +action.escu.analytic_story = ["Deobfuscate-Decode Files or Information", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 40}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -7852,7 +7852,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CertUtil With Decode Argument - Rule -action.correlationsearch.annotations = {"analytic_story": ["Deobfuscate-Decode Files or Information"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Deobfuscate-Decode Files or Information", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -8209,7 +8209,7 @@ action.escu.full_search_name = ESCU - CMD Carry Out String Command Parameter - R action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper"] +action.escu.analytic_story = ["IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting spawn a new process. action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}] @@ -8220,7 +8220,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CMD Carry Out String Command Parameter - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "cve": ["CVE-2021-44228"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003", "T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Log4Shell CVE-2021-44228", "WhisperGate", "Hermetic Wiper", "Living Off The Land"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "cve": ["CVE-2021-44228"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003", "T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -8566,7 +8566,7 @@ action.escu.full_search_name = ESCU - Control Loading from World Writable Direct action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Microsoft MSHTML Remote Code Execution CVE-2021-40444"] +action.escu.analytic_story = ["Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -8577,7 +8577,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Control Loading from World Writable Directory - Rule -action.correlationsearch.annotations = {"analytic_story": ["Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -8888,7 +8888,7 @@ action.escu.full_search_name = ESCU - Creation of Shadow Copy with wmic and powe action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Credential Dumping"] +action.escu.analytic_story = ["Credential Dumping", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -8899,7 +8899,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Creation of Shadow Copy with wmic and powershell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -9668,7 +9668,7 @@ action.escu.full_search_name = ESCU - Detect HTML Help Renamed - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] +action.escu.analytic_story = ["Suspicious Compiled HTML Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -9679,7 +9679,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect HTML Help Renamed - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -9708,7 +9708,7 @@ action.escu.full_search_name = ESCU - Detect HTML Help Spawn Child Process - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] +action.escu.analytic_story = ["Suspicious Compiled HTML Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -9719,7 +9719,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect HTML Help Spawn Child Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -9754,7 +9754,7 @@ action.escu.full_search_name = ESCU - Detect HTML Help URL in Command Line - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] +action.escu.analytic_story = ["Suspicious Compiled HTML Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -9765,7 +9765,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect HTML Help URL in Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -9800,7 +9800,7 @@ action.escu.full_search_name = ESCU - Detect HTML Help Using InfoTech Storage Ha action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] +action.escu.analytic_story = ["Suspicious Compiled HTML Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -9811,7 +9811,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -9944,7 +9944,7 @@ action.escu.full_search_name = ESCU - Detect mshta inline hta execution - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious MSHTA Activity"] +action.escu.analytic_story = ["Suspicious MSHTA Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -9955,7 +9955,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect mshta inline hta execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -9990,7 +9990,7 @@ action.escu.full_search_name = ESCU - Detect mshta renamed - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious MSHTA Activity"] +action.escu.analytic_story = ["Suspicious MSHTA Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -10001,7 +10001,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect mshta renamed - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -10030,7 +10030,7 @@ action.escu.full_search_name = ESCU - Detect MSHTA Url in Command Line - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious MSHTA Activity"] +action.escu.analytic_story = ["Suspicious MSHTA Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -10041,7 +10041,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect MSHTA Url in Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -10346,7 +10346,7 @@ action.escu.full_search_name = ESCU - Detect Regasm Spawning a Process - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -10357,7 +10357,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regasm Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -10392,7 +10392,7 @@ action.escu.full_search_name = ESCU - Detect Regasm with Network Connection - Ru action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -10403,7 +10403,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regasm with Network Connection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -10431,14 +10431,14 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in `C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe` and `C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe`. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. action.escu.known_false_positives = Although unlikely, limited instances of regasm.exe or may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. -action.escu.creation_date = 2021-09-20 -action.escu.modification_date = 2021-09-20 +action.escu.creation_date = 2022-03-15 +action.escu.modification_date = 2022-03-15 action.escu.confidence = high action.escu.full_search_name = ESCU - Detect Regasm with no Command Line Arguments - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -10449,7 +10449,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regasm with no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -10466,7 +10466,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_regasm` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_regasm` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(regasm\.exe.{0,4}$)" | `detect_regasm_with_no_command_line_arguments_filter` [ESCU - Detect Regsvcs Spawning a Process - Rule] action.escu = 0 @@ -10484,7 +10484,7 @@ action.escu.full_search_name = ESCU - Detect Regsvcs Spawning a Process - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ typically not normal for this process. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -10495,7 +10495,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvcs Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -10530,7 +10530,7 @@ action.escu.full_search_name = ESCU - Detect Regsvcs with Network Connection - R action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -10541,7 +10541,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvcs with Network Connection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -10569,14 +10569,14 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Regasm.exe are natively found in C:\Windows\Microsoft.NET\Framework\v*\regasm|regsvcs.exe and C:\Windows\Microsoft.NET\Framework64\v*\regasm|regsvcs.exe. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. action.escu.known_false_positives = Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. -action.escu.creation_date = 2021-09-20 -action.escu.modification_date = 2021-09-20 +action.escu.creation_date = 2022-03-15 +action.escu.modification_date = 2022-03-15 action.escu.confidence = high action.escu.full_search_name = ESCU - Detect Regsvcs with No Command Line Arguments - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = The process $process_name$ was spawned by $parent_process_name$ without any command-line arguments on $dest$ by $user$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -10587,7 +10587,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvcs with No Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -10604,7 +10604,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_regsvcs` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(regsvcs\.exe.{0,4}$)"| `detect_regsvcs_with_no_command_line_arguments_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_regsvcs` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(regsvcs\.exe.{0,4}$)"| `detect_regsvcs_with_no_command_line_arguments_filter` [ESCU - Detect Regsvr32 Application Control Bypass - Rule] action.escu = 0 @@ -10624,7 +10624,7 @@ action.escu.full_search_name = ESCU - Detect Regsvr32 Application Control Bypass action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Cobalt Strike"] +action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Cobalt Strike", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -10635,7 +10635,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvr32 Application Control Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Cobalt Strike"], "cis20": ["CIS 8", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Cobalt Strike", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -10831,7 +10831,7 @@ action.escu.full_search_name = ESCU - Detect Rundll32 Application Control Bypass action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -10842,7 +10842,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -10877,7 +10877,7 @@ action.escu.full_search_name = ESCU - Detect Rundll32 Application Control Bypass action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -10888,7 +10888,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -10923,7 +10923,7 @@ action.escu.full_search_name = ESCU - Detect Rundll32 Application Control Bypass action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -10934,7 +10934,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -10969,7 +10969,7 @@ action.escu.full_search_name = ESCU - Detect Rundll32 Inline HTA Execution - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious MSHTA Activity", "NOBELIUM Group"] +action.escu.analytic_story = ["Suspicious MSHTA Activity", "NOBELIUM Group", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = Suspicious rundll32.exe inline HTA execution on $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] @@ -10980,7 +10980,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Inline HTA Execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "NOBELIUM Group"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "NOBELIUM Group", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -11720,7 +11720,7 @@ action.escu.full_search_name = ESCU - Disable Schedule Task - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["IcedID"] +action.escu.analytic_story = ["IcedID", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = schtask process with commandline $process$ to disable schedule task in $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] @@ -11731,7 +11731,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Schedule Task - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001", "T1562"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -12587,8 +12587,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies DLLHost.exe with no command line arguments with a network connection. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. action.escu.known_false_positives = Although unlikely, some legitimate third party applications may use a moved copy of dllhost, triggering a false positive. -action.escu.creation_date = 2021-10-13 -action.escu.modification_date = 2021-10-13 +action.escu.creation_date = 2022-03-15 +action.escu.modification_date = 2022-03-15 action.escu.confidence = high action.escu.full_search_name = ESCU - DLLHost with no Command Line Arguments with Network - Rule action.escu.search_type = detection @@ -12622,7 +12622,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(dllhost\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(dllhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name process_name process_path process process_id dest_port C2 | `dllhost_with_no_command_line_arguments_with_network_filter` [ESCU - DNS Exfiltration Using Nslookup App - Rule] action.escu = 0 @@ -13217,7 +13217,7 @@ action.escu.full_search_name = ESCU - Dump LSASS via comsvcs DLL - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"] +action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -13228,7 +13228,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Dump LSASS via comsvcs DLL - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group", "Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -13582,7 +13582,7 @@ action.escu.full_search_name = ESCU - Esentutl SAM Copy - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Credential Dumping"] +action.escu.analytic_story = ["Credential Dumping", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user user$ attempting to capture credentials for offline cracking or observability. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -13593,7 +13593,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Esentutl SAM Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002", "T1003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -13830,6 +13830,46 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "sc.exe" AND Processes.process="*config*" OR Processes.process="*Disabled*" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_attempt_to_disable_services_filter` +[ESCU - Excessive distinct processes from Windows Temp - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. +action.escu.known_false_positives = Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed. +action.escu.creation_date = 2022-02-28 +action.escu.modification_date = 2022-02-28 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Excessive distinct processes from Windows Temp - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Meterpreter"] +action.risk = 1 +action.risk.param._risk_message = Multiple processes were executed out of windows\temp within a short amount of time on $dest$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Excessive distinct processes from Windows Temp - Rule +action.correlationsearch.annotations = {"analytic_story": ["Meterpreter"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` values(Processes.process) as process distinct_count(Processes.process) as distinct_process_count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\Windows\\Temp\\*" by Processes.dest Processes.user _time span=20m | where distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_distinct_processes_from_windows_temp_filter` + [ESCU - Excessive File Deletion In WinDefender Folder - Rule] action.escu = 0 action.escu.enabled = 1 @@ -13876,46 +13916,6 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode=23 TargetFilename = "*\\ProgramData\\Microsoft\\Windows Defender*" | stats values(TargetFilename) as deleted_files min(_time) as firstTime max(_time) as lastTime count by user EventCode Image ProcessID Computer |where count >=50 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_file_deletion_in_windefender_folder_filter` -[ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp to execute actions on objective. This behavior is extremely anomalous compared to typical application behaviors that use Windows\Temp. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the full process path in the process field of CIM's Process data model. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed sc.exe may be used. -action.escu.known_false_positives = Many benign applications will create processes from executables in Windows\Temp, although unlikely to exceed the given threshold. Filter as needed. -action.escu.creation_date = 2022-02-28 -action.escu.modification_date = 2022-02-28 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Meterpreter"] -action.risk = 1 -action.risk.param._risk_message = Multiple processes were executed out of windows\temp within a short amount of time on $dest$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule -action.correlationsearch.annotations = {"analytic_story": ["Meterpreter"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` values(Processes.process) as process distinct_count(Processes.process) as distinct_process_count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\Windows\\Temp\\*" by Processes.dest Processes.user _time span=20m | where distinct_process_count > 37 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_number_of_distinct_processes_created_in_windows_temp_folder_filter` - [ESCU - Excessive number of service control start as disabled - Rule] action.escu = 0 action.escu.enabled = 1 @@ -16407,8 +16407,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies gpupdate.exe with no command line arguments and with a network connection. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. action.escu.known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process. -action.escu.creation_date = 2021-04-19 -action.escu.modification_date = 2021-04-19 +action.escu.creation_date = 2022-03-15 +action.escu.modification_date = 2022-03-15 action.escu.confidence = high action.escu.full_search_name = ESCU - GPUpdate with no Command Line Arguments with Network - Rule action.escu.search_type = detection @@ -16442,7 +16442,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(gpupdate\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(gpupdate\.exe.{0,4}$)"| join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name process_name process_path process process_id dest_port C2 | `gpupdate_with_no_command_line_arguments_with_network_filter` [ESCU - Hide User Account From Sign-In Screen - Rule] action.escu = 0 @@ -19242,7 +19242,7 @@ action.escu.full_search_name = ESCU - Mmc LOLBAS Execution Process Spawn - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Active Directory Lateral Movement"] +action.escu.analytic_story = ["Active Directory Lateral Movement", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = Mmc.exe spawned a LOLBAS process on $dest action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}] @@ -19253,7 +19253,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Mmc LOLBAS Execution Process Spawn - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Living Off The Land"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021", "T1021.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -19552,7 +19552,7 @@ action.escu.full_search_name = ESCU - Mshta spawning Rundll32 OR Regsvr32 Proces action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Trickbot", "IcedID"] +action.escu.analytic_story = ["Trickbot", "IcedID", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] @@ -19563,7 +19563,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot", "IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot", "IcedID", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -19724,98 +19724,6 @@ realtime_schedule = 0 is_visible = false search = |tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where (Filesystem.file_name = "msmpeng.exe" OR Filesystem.file_name = "mpsvc.dll") AND Filesystem.file_path != "*\\Program Files\\windows defender\\*" by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `msmpeng_application_dll_side_loading_filter` -[ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ -The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ -This detection will only trigger on domain controllers, not on member servers or workstations.\ -The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} -action.escu.data_models = [] -action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ -The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ -This detection will only trigger on domain controllers, not on member servers or workstations.\ -The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. -action.escu.known_false_positives = A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems. -action.escu.creation_date = 2021-04-14 -action.escu.modification_date = 2021-04-14 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Active Directory Password Spraying", "Active Directory Kerberos Attacks"] -action.risk = 1 -action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ -action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying", "Active Directory Kerberos Attacks"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos_filter` - -[ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ -The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ -This detection will only trigger on domain controllers, not on member servers or workstations.\ -The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} -action.escu.data_models = [] -action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ -The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ -This detection will only trigger on domain controllers, not on member servers or workstations.\ -The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. -action.escu.known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. -action.escu.creation_date = 2021-04-14 -action.escu.modification_date = 2021-04-14 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Active Directory Password Spraying", "Active Directory Kerberos Attacks"] -action.risk = 1 -action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ -action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying", "Active Directory Kerberos Attacks"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos_filter` - [ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule] action.escu = 0 action.escu.enabled = 1 @@ -19862,52 +19770,6 @@ realtime_schedule = 0 is_visible = false search = `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter` -[ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ -The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ -This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ -The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} -action.escu.data_models = [] -action.escu.eli5 = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ -The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ -This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ -The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. -action.escu.known_false_positives = A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. -action.escu.creation_date = 2021-04-13 -action.escu.modification_date = 2021-04-13 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Active Directory Password Spraying"] -action.risk = 1 -action.risk.param._risk_message = Potential password spraying attack from $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] -action.risk.param._risk_score = 0 -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_attempting_to_authenticate_using_explicit_credentials_filter` - [ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule] action.escu = 0 action.escu.enabled = 1 @@ -20530,7 +20392,7 @@ action.escu.full_search_name = ESCU - Ntdsutil Export NTDS - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] +action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = Active Directory NTDS export on $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 50}] @@ -20541,7 +20403,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Ntdsutil Export NTDS - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003", "T1003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -22161,7 +22023,7 @@ realtime_schedule = 0 is_visible = false search = `powershell` EventCode=4104 Message = "*get-localgroup*" | stats count min(_time) as firstTime max(_time) as lastTime by Message OpCode ComputerName User EventCode| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_get_localgroup_discovery_with_script_block_logging_filter` -[ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule] +[ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule] action.escu = 0 action.escu.enabled = 1 description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ @@ -22177,7 +22039,7 @@ action.escu.known_false_positives = False positives should be limited as day to action.escu.creation_date = 2021-06-10 action.escu.modification_date = 2021-06-10 action.escu.confidence = high -action.escu.full_search_name = ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule +action.escu.full_search_name = ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] @@ -22191,7 +22053,7 @@ cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule +action.correlationsearch.label = ESCU - PowerShell Loading DotNET into Memory via Reflection - Rule action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 @@ -22199,7 +22061,7 @@ action.notable.param.nes_fields = [] action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. -action.notable.param.rule_title = PowerShell Loading DotNET into Memory via System Reflection Assembly +action.notable.param.rule_title = PowerShell Loading DotNET into Memory via Reflection action.notable.param.security_domain = endpoint action.notable.param.severity = high alert.digest_mode = 1 @@ -22211,7 +22073,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*") | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter` +search = `powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*") | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter` [ESCU - Powershell Processing Stream Of Data - Rule] action.escu = 0 @@ -23106,7 +22968,7 @@ action.escu.full_search_name = ESCU - Reg exe Manipulating Windows Services Regi action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Windows Service Abuse", "Windows Persistence Techniques"] +action.escu.analytic_story = ["Windows Service Abuse", "Windows Persistence Techniques", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = A reg.exe process $process_name$ with commandline $process$ in host $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 45}] @@ -23117,7 +22979,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Windows Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 75, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011", "T1574"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Windows Persistence Techniques", "Living Off The Land"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 75, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011", "T1574"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -23290,7 +23152,7 @@ action.escu.full_search_name = ESCU - Regsvr32 Silent and Install Param Dll Load action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Remcos", "Hermetic Wiper"] +action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Remcos", "Hermetic Wiper", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent and dllinstall parameter. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -23301,7 +23163,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Regsvr32 Silent and Install Param Dll Loading - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Remcos", "Hermetic Wiper"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Remcos", "Hermetic Wiper", "Living Off The Land"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -23330,7 +23192,7 @@ action.escu.full_search_name = ESCU - Regsvr32 with Known Silent Switch Cmdline action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["IcedID", "Suspicious Regsvr32 Activity", "Remcos"] +action.escu.analytic_story = ["IcedID", "Suspicious Regsvr32 Activity", "Remcos", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a DLL using the silent parameter. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -23341,7 +23203,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Regsvr32 with Known Silent Switch Cmdline - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Suspicious Regsvr32 Activity", "Remcos"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Suspicious Regsvr32 Activity", "Remcos", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.010"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -24002,7 +23864,7 @@ action.escu.full_search_name = ESCU - Remote WMI Command Attempt - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious WMI Use"] +action.escu.analytic_story = ["Suspicious WMI Use", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = A wmic.exe process $process$ contain node commandline $process$ in host $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] @@ -24013,7 +23875,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Remote WMI Command Attempt - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use", "Living Off The Land"], "cis20": ["CIS 3", "CIS 5"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -24318,7 +24180,7 @@ action.escu.full_search_name = ESCU - Rundll32 Control RunDLL Hunt - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"] +action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 15}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -24329,7 +24191,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Rundll32 Control RunDLL Hunt - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -24358,7 +24220,7 @@ action.escu.full_search_name = ESCU - Rundll32 Control RunDLL World Writable Dir action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"] +action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to load a suspicious file from disk. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -24369,7 +24231,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Rundll32 Control RunDLL World Writable Directory - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Microsoft MSHTML Remote Code Execution CVE-2021-40444", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "cve": ["CVE-2021-40444"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -24404,7 +24266,7 @@ action.escu.full_search_name = ESCU - Rundll32 Create Remote Thread To A Process action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["IcedID"] +action.escu.analytic_story = ["IcedID", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = rundl32 process $SourceImage$ create a remote thread to process $TargetImage$ in host $Computer$ action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "SourceImage", "threat_object_type": "process"}] @@ -24415,7 +24277,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Rundll32 Create Remote Thread To A Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -24450,7 +24312,7 @@ action.escu.full_search_name = ESCU - Rundll32 CreateRemoteThread In Browser - R action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["IcedID"] +action.escu.analytic_story = ["IcedID", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = rundl32 process $SourceImage$ create a remote thread to browser process $TargetImage$ in host $Computer$ action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "SourceImage", "threat_object_type": "process"}] @@ -24461,7 +24323,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Rundll32 CreateRemoteThread In Browser - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "SourceImage", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -24496,7 +24358,7 @@ action.escu.full_search_name = ESCU - Rundll32 DNSQuery - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["IcedID"] +action.escu.analytic_story = ["IcedID", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = rundll32 process $process_name$ having a dns query to $QueryName$ in host $Computer$ action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -24507,7 +24369,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Rundll32 DNSQuery - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -24542,7 +24404,7 @@ action.escu.full_search_name = ESCU - Rundll32 Process Creating Exe Dll Files - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["IcedID"] +action.escu.analytic_story = ["IcedID", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = rundll32 process $process_name$ drops a file $TargetFilename$ in host $dest$ action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -24553,7 +24415,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Rundll32 Process Creating Exe Dll Files - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -24588,7 +24450,7 @@ action.escu.full_search_name = ESCU - Rundll32 Shimcache Flush - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Unusual Processes"] +action.escu.analytic_story = ["Unusual Processes", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = rundll32 process execute $process$ to clear shim cache in $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 80}] @@ -24599,7 +24461,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Rundll32 Shimcache Flush - Rule -action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "confidence": 100, "context": ["Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes", "Living Off The Land"], "confidence": 100, "context": ["Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -24627,8 +24489,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, triage any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node. To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. action.escu.known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. -action.escu.creation_date = 2021-10-13 -action.escu.modification_date = 2021-10-13 +action.escu.creation_date = 2022-03-15 +action.escu.modification_date = 2022-03-15 action.escu.confidence = high action.escu.full_search_name = ESCU - Rundll32 with no Command Line Arguments with Network - Rule action.escu.search_type = detection @@ -24662,7 +24524,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(rundll32\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `rundll32_with_no_command_line_arguments_with_network_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name process_name process_path process process_id dest_port C2 | `rundll32_with_no_command_line_arguments_with_network_filter` [ESCU - RunDLL Loading DLL By Ordinal - Rule] action.escu = 0 @@ -24680,7 +24542,7 @@ action.escu.full_search_name = ESCU - RunDLL Loading DLL By Ordinal - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Unusual Processes", "Suspicious Rundll32 Activity"] +action.escu.analytic_story = ["Unusual Processes", "Suspicious Rundll32 Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ on host $dest$. action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] @@ -24691,7 +24553,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - RunDLL Loading DLL By Ordinal - Rule -action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes", "Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes", "Suspicious Rundll32 Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -24990,7 +24852,7 @@ action.escu.full_search_name = ESCU - Schedule Task with HTTP Command Arguments action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Windows Persistence Techniques"] +action.escu.analytic_story = ["Windows Persistence Techniques", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] @@ -25001,7 +24863,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Schedule Task with HTTP Command Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Living Off The Land"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -25036,7 +24898,7 @@ action.escu.full_search_name = ESCU - Schedule Task with Rundll32 Command Trigge action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Windows Persistence Techniques", "Trickbot", "IcedID"] +action.escu.analytic_story = ["Windows Persistence Techniques", "Trickbot", "IcedID", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}] @@ -25047,7 +24909,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Schedule Task with Rundll32 Command Trigger - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Trickbot", "IcedID"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Trickbot", "IcedID", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -25082,7 +24944,7 @@ action.escu.full_search_name = ESCU - Scheduled Task Creation on Remote Endpoint action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Active Directory Lateral Movement"] +action.escu.analytic_story = ["Active Directory Lateral Movement", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = A Windows Scheduled Task was created on a remote endpoint from $dest action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}] @@ -25093,7 +24955,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Scheduled Task Creation on Remote Endpoint using At - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Living Off The Land"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -25128,7 +24990,7 @@ action.escu.full_search_name = ESCU - Scheduled Task Deleted Or Created via CMD action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["DHS Report TA18-074A", "NOBELIUM Group", "Windows Persistence Techniques"] +action.escu.analytic_story = ["DHS Report TA18-074A", "NOBELIUM Group", "Windows Persistence Techniques", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] @@ -25139,7 +25001,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Scheduled Task Deleted Or Created via CMD - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group", "Windows Persistence Techniques"], "cis20": ["CIS 3"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group", "Windows Persistence Techniques", "Living Off The Land"], "cis20": ["CIS 3"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -25174,7 +25036,7 @@ action.escu.full_search_name = ESCU - Scheduled Task Initiation on Remote Endpoi action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Active Directory Lateral Movement"] +action.escu.analytic_story = ["Active Directory Lateral Movement", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = A Windows Scheduled Task was ran on a remote endpoint from $dest action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}] @@ -25185,7 +25047,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Scheduled Task Initiation on Remote Endpoint - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Living Off The Land"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -25266,7 +25128,7 @@ action.escu.full_search_name = ESCU - Schtasks scheduling job on remote system - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Active Directory Lateral Movement", "NOBELIUM Group"] +action.escu.analytic_story = ["Active Directory Lateral Movement", "NOBELIUM Group", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = A schedule task process $process_name$ with remote job commandline $process$ in host $dest$ action.risk.param._risk = [{"risk_object_field": "Processes.dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "Processes.user", "risk_object_type": "user", "risk_score": 63}] @@ -25277,7 +25139,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Schtasks scheduling job on remote system - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "NOBELIUM Group"], "cis20": ["CIS 3"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Processes.user", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "NOBELIUM Group", "Living Off The Land"], "cis20": ["CIS 3"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005", "T1053"], "nist": ["PR.IP"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Processes.user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -25535,8 +25397,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies searchprotocolhost.exe with no command line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node. action.escu.known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process. -action.escu.creation_date = 2021-10-13 -action.escu.modification_date = 2021-10-13 +action.escu.creation_date = 2022-03-15 +action.escu.modification_date = 2022-03-15 action.escu.confidence = high action.escu.full_search_name = ESCU - SearchProtocolHost with no Command Line with Network - Rule action.escu.search_type = detection @@ -25570,7 +25432,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(searchprotocolhost\.exe.{0,4}$)" | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name process_name process_path process process_id dest_port C2 | `searchprotocolhost_with_no_command_line_with_network_filter` [ESCU - SecretDumps Offline NTDS Dumping Tool - Rule] action.escu = 0 @@ -25805,7 +25667,7 @@ action.escu.full_search_name = ESCU - Services LOLBAS Execution Process Spawn - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Active Directory Lateral Movement"] +action.escu.analytic_story = ["Active Directory Lateral Movement", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = Services.exe spawned a LOLBAS process on $dest action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}] @@ -25816,7 +25678,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Services LOLBAS Execution Process Spawn - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543", "T1543.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Living Off The Land"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543", "T1543.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -26672,8 +26534,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies DLLHost.exe with no command line arguments. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. action.escu.known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process. -action.escu.creation_date = 2021-09-20 -action.escu.modification_date = 2021-09-20 +action.escu.creation_date = 2022-03-15 +action.escu.modification_date = 2022-03-15 action.escu.confidence = high action.escu.full_search_name = ESCU - Suspicious DLLHost no Command Line Arguments - Rule action.escu.search_type = detection @@ -26707,7 +26569,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_dllhost` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_dllhost` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(dllhost\.exe.{0,4}$)" | `suspicious_dllhost_no_command_line_arguments_filter` [ESCU - Suspicious Driver Loaded Path - Rule] action.escu = 0 @@ -26810,8 +26672,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies gpupdate.exe with no command line arguments. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. action.escu.known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process. -action.escu.creation_date = 2021-09-20 -action.escu.modification_date = 2021-09-20 +action.escu.creation_date = 2022-03-15 +action.escu.modification_date = 2022-03-15 action.escu.confidence = high action.escu.full_search_name = ESCU - Suspicious GPUpdate no Command Line Arguments - Rule action.escu.search_type = detection @@ -26845,7 +26707,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_gpupdate` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(gpupdate\.exe.{0,4}$)" | `suspicious_gpupdate_no_command_line_arguments_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_gpupdate` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(gpupdate\.exe.{0,4}$)" | `suspicious_gpupdate_no_command_line_arguments_filter` [ESCU - Suspicious IcedID Rundll32 Cmdline - Rule] action.escu = 0 @@ -26863,7 +26725,7 @@ action.escu.full_search_name = ESCU - Suspicious IcedID Rundll32 Cmdline - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["IcedID"] +action.escu.analytic_story = ["IcedID", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = rundll32 process $process_name$ with commandline $process$ in host $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -26874,7 +26736,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious IcedID Rundll32 Cmdline - Rule -action.correlationsearch.annotations = {"analytic_story": ["IcedID"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["IcedID", "Living Off The Land"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -27050,7 +26912,7 @@ action.escu.full_search_name = ESCU - Suspicious microsoft workflow compiler ren action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"] +action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ by $user$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] @@ -27061,7 +26923,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious microsoft workflow compiler rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -27090,7 +26952,7 @@ action.escu.full_search_name = ESCU - Suspicious microsoft workflow compiler usa action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution"] +action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] @@ -27101,7 +26963,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious microsoft workflow compiler usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -27136,7 +26998,7 @@ action.escu.full_search_name = ESCU - Suspicious msbuild path - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"] +action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] @@ -27147,7 +27009,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious msbuild path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003", "T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003", "T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -27182,7 +27044,7 @@ action.escu.full_search_name = ESCU - Suspicious MSBuild Rename - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"] +action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] @@ -27193,7 +27055,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious MSBuild Rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003", "T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1127", "T1036.003", "T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -27228,7 +27090,7 @@ action.escu.full_search_name = ESCU - Suspicious MSBuild Spawn - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild"] +action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = Suspicious msbuild.exe process executed on $dest$ by $user$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 42}] @@ -27239,7 +27101,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious MSBuild Spawn - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -27274,7 +27136,7 @@ action.escu.full_search_name = ESCU - Suspicious mshta child process - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious MSHTA Activity"] +action.escu.analytic_story = ["Suspicious MSHTA Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = suspicious mshta child process detected on host $dest$ by user $user$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 40}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}, {"threat_object_field": "parent_process", "threat_object_type": "process name"}] @@ -27285,7 +27147,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious mshta child process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Process Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -27320,7 +27182,7 @@ action.escu.full_search_name = ESCU - Suspicious mshta spawn - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious MSHTA Activity"] +action.escu.analytic_story = ["Suspicious MSHTA Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = mshta.exe spawned by wmiprvse.exe on $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] @@ -27331,7 +27193,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious mshta spawn - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218", "T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -27544,7 +27406,7 @@ action.escu.full_search_name = ESCU - Suspicious Regsvr32 Register Suspicious Pa action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Iceid"] +action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Iceid", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process potentially loading malicious code action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] @@ -27555,7 +27417,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Iceid"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Iceid", "Living Off The Land"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -27590,7 +27452,7 @@ action.escu.full_search_name = ESCU - Suspicious Rundll32 dllregisterserver - Ru action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = $Processes.process_path.file_path$ process potentially loading malicious code action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] @@ -27601,7 +27463,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 dllregisterserver - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Living Off The Land"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218", "T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -27721,8 +27583,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. action.escu.known_false_positives = Although unlikely, some legitimate applications may use a moved copy of rundll32, triggering a false positive. -action.escu.creation_date = 2021-09-20 -action.escu.modification_date = 2021-09-20 +action.escu.creation_date = 2022-03-15 +action.escu.modification_date = 2022-03-15 action.escu.confidence = high action.escu.full_search_name = ESCU - Suspicious Rundll32 no Command Line Arguments - Rule action.escu.search_type = detection @@ -27756,7 +27618,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_rundll32` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(rundll32\.exe.{0,4}$)" | `suspicious_rundll32_no_command_line_arguments_filter` [ESCU - Suspicious Scheduled Task from Public Directory - Rule] action.escu = 0 @@ -27774,7 +27636,7 @@ action.escu.full_search_name = ESCU - Suspicious Scheduled Task from Public Dire action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"] +action.escu.analytic_story = ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = Suspicious scheduled task registered on $dest$ action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] @@ -27785,7 +27647,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Scheduled Task from Public Directory - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques", "Living Off The Land"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053.005", "T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -27807,8 +27669,8 @@ action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytic identifies searchprotocolhost.exe with no command line arguments. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. During investigation, identify any network connections and parallel processes. Identify any suspicious module loads related to credential dumping or file writes. searchprotocolhost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. action.escu.known_false_positives = Limited false positives may be present in small environments. Tuning may be required based on parent process. -action.escu.creation_date = 2021-09-20 -action.escu.modification_date = 2021-09-20 +action.escu.creation_date = 2022-03-15 +action.escu.modification_date = 2022-03-15 action.escu.confidence = high action.escu.full_search_name = ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule action.escu.search_type = detection @@ -27842,7 +27704,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(searchprotocolhost\.exe.{0,4}$)" | `suspicious_searchprotocolhost_no_command_line_arguments_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | regex process="(?i)(searchprotocolhost\.exe.{0,4}$)" | `suspicious_searchprotocolhost_no_command_line_arguments_filter` [ESCU - Suspicious Ticket Granting Ticket Request - Rule] action.escu = 0 @@ -28038,7 +27900,7 @@ action.escu.full_search_name = ESCU - Svchost LOLBAS Execution Process Spawn - R action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Active Directory Lateral Movement"] +action.escu.analytic_story = ["Active Directory Lateral Movement", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = Svchost.exe spawned a LOLBAS process on $dest action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}] @@ -28049,7 +27911,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Svchost LOLBAS Execution Process Spawn - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Lateral Movement", "Living Off The Land"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053", "T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -29770,6 +29632,52 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_value_name="DisableAntiSpyware" AND Registry.registry_value_data="0x00000001" by Registry.dest Registry.user Registry.registry_path Registry.registry_value_data | `drop_dm_object_name(Registry)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_disableantispyware_registry_filter` +[ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +action.escu.known_false_positives = A host failing to authenticate with multiple disabled domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems missconfigured systems. +action.escu.creation_date = 2021-04-14 +action.escu.modification_date = 2021-04-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Password Spraying", "Active Directory Kerberos Attacks"] +action.risk = 1 +action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ +action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Disabled Users Failing To Authenticate Kerberos - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying", "Active Directory Kerberos Attacks"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` + [ESCU - Windows DiskCryptor Usage - Rule] action.escu = 0 action.escu.enabled = 1 @@ -30317,7 +30225,7 @@ action.escu.full_search_name = ESCU - Windows InstallUtil in Non Standard Path - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Masquerading - Rename System Utilities", "Unusual Processes", "Ransomware", "Signed Binary Proxy Execution InstallUtil", "WhisperGate"] +action.escu.analytic_story = ["Masquerading - Rename System Utilities", "Unusual Processes", "Ransomware", "Signed Binary Proxy Execution InstallUtil", "WhisperGate", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ from a non-standard path was identified on endpoint $dest$ by user $user$. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -30328,7 +30236,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows InstallUtil in Non Standard Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Masquerading - Rename System Utilities", "Unusual Processes", "Ransomware", "Signed Binary Proxy Execution InstallUtil", "WhisperGate"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1036.003", "T1218", "T1218.004"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Masquerading - Rename System Utilities", "Unusual Processes", "Ransomware", "Signed Binary Proxy Execution InstallUtil", "WhisperGate", "Living Off The Land"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1036.003", "T1218", "T1218.004"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -30362,14 +30270,14 @@ If used by a developer, typically this will be found with multiple command-line During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. action.escu.known_false_positives = Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements. -action.escu.creation_date = 2021-11-12 -action.escu.modification_date = 2021-11-12 +action.escu.creation_date = 2022-03-16 +action.escu.modification_date = 2022-03-16 action.escu.confidence = high action.escu.full_search_name = ESCU - Windows InstallUtil Remote Network Connection - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil"] +action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ generating a remote download. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -30380,7 +30288,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows InstallUtil Remote Network Connection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Signed Binary Proxy Execution InstallUtil"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -30400,7 +30308,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_installutil` by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name process_path process process_guid connection_to_CNC dest_port | `windows_installutil_remote_network_connection_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_installutil` by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name process_name process_path process process_id dest_port C2 | `windows_installutil_remote_network_connection_filter` [ESCU - Windows InstallUtil Uninstall Option - Rule] action.escu = 0 @@ -30426,7 +30334,7 @@ action.escu.full_search_name = ESCU - Windows InstallUtil Uninstall Option - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil"] +action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -30437,7 +30345,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows InstallUtil Uninstall Option - Rule -action.correlationsearch.annotations = {"analytic_story": ["Signed Binary Proxy Execution InstallUtil"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -30477,14 +30385,14 @@ If used by a developer, typically this will be found with multiple command-line During triage review resulting network connections, file modifications, and parallel processes. Capture any artifacts and review further. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` and `Ports` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. action.escu.known_false_positives = Limited false positives should be present as InstallUtil is not typically used to download remote files. Filter as needed based on Developers requirements. -action.escu.creation_date = 2021-11-12 -action.escu.modification_date = 2021-11-12 +action.escu.creation_date = 2022-03-16 +action.escu.modification_date = 2022-03-16 action.escu.confidence = high action.escu.full_search_name = ESCU - Windows InstallUtil Uninstall Option with Network - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil"] +action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing an uninstall. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -30495,7 +30403,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows InstallUtil Uninstall Option with Network - Rule -action.correlationsearch.annotations = {"analytic_story": ["Signed Binary Proxy Execution InstallUtil"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -30516,7 +30424,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time span=1h Processes.process_guid Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_guid [ | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_guid Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name original_file_name process_path process process_guid connection_to_CNC dest_port | `windows_installutil_uninstall_option_with_network_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*/u*", "*uninstall*") by _time span=1h Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port != 0 by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port | `drop_dm_object_name(All_Traffic)` | rename dest as C2 ] | table _time dest parent_process_name process_name process_path process process_id dest_port C2 | `windows_installutil_uninstall_option_with_network_filter` [ESCU - Windows InstallUtil URL in Command Line - Rule] action.escu = 0 @@ -30540,7 +30448,7 @@ action.escu.full_search_name = ESCU - Windows InstallUtil URL in Command Line - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil"] +action.escu.analytic_story = ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"] action.risk = 1 action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ passing a URL on the command-line. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] @@ -30551,7 +30459,7 @@ dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows InstallUtil URL in Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Signed Binary Proxy Execution InstallUtil"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} +action.correlationsearch.annotations = {"analytic_story": ["Signed Binary Proxy Execution InstallUtil", "Living Off The Land"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.004", "T1218"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] @@ -30573,6 +30481,52 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_installutil` Processes.process IN ("*http://*","*https://*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_installutil_url_in_command_line_filter` +[ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will only trigger on domain controllers, not on member servers or workstations.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +action.escu.known_false_positives = A host failing to authenticate with multiple invalid domain users is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, multi-user systems and missconfigured systems. +action.escu.creation_date = 2021-04-14 +action.escu.modification_date = 2021-04-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Password Spraying", "Active Directory Kerberos Attacks"] +action.risk = 1 +action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ +action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Invalid Users Failed Authentication via Kerberos - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying", "Active Directory Kerberos Attacks"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `windows_invalid_users_failed_authentication_via_kerberos_filter` + [ESCU - Windows Modify Show Compress Color And Info Tip Registry - Rule] action.escu = 0 action.escu.enabled = 1 @@ -31395,6 +31349,52 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=sc.exe OR Processes.original_file_name=sc.exe) (Processes.process=*\\\\* AND Processes.process=*start*) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_service_initiation_on_remote_endpoint_filter` +[ESCU - Windows Users Authenticate Using Explicit Credentials - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ +The detection calculates the standard deviation for each host and leverages the 3-sigma statistical rule to identify an unusual number of users. To customize this analytic, users can try different combinations of the `bucket` span time and the calculation of the `upperBound` field. This logic can be used for real time security monitoring as well as threat hunting exercises.\ +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a password spraying attack is being executed.\ +The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs to be enabled. +action.escu.known_false_positives = A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. +action.escu.creation_date = 2021-04-13 +action.escu.modification_date = 2021-04-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Users Authenticate Using Explicit Credentials - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Active Directory Password Spraying"] +action.risk = 1 +action.risk.param._risk_message = Potential password spraying attack from $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk_score = 0 +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Users Authenticate Using Explicit Credentials - Rule +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003", "T1110"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter` + [ESCU - Windows WMI Process Call Create - Rule] action.escu = 0 action.escu.enabled = 1 @@ -34329,7 +34329,7 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process="*com.apple.loginwindow*" by Processes.user Processes.process_name Processes.parent_process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `macos___re_opened_applications_filter` -[ESCU - Microsoft Exchange Mailbox Replication service writing Active Server Pages - Rule] +[ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule] action.escu = 0 action.escu.enabled = 1 description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. The analytic is limited to process name MSExchangeMailboxReplication.exe, which typically does not write .aspx files to disk. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant. @@ -34341,7 +34341,7 @@ action.escu.known_false_positives = The query is structured in a way that `actio action.escu.creation_date = 2021-12-07 action.escu.modification_date = 2021-12-07 action.escu.confidence = high -action.escu.full_search_name = ESCU - Microsoft Exchange Mailbox Replication service writing Active Server Pages - Rule +action.escu.full_search_name = ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] @@ -34355,13 +34355,13 @@ cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Microsoft Exchange Mailbox Replication service writing Active Server Pages - Rule +action.correlationsearch.label = ESCU - MS Exchange Mailbox Replication service writing Active Server Pages - Rule action.correlationsearch.annotations = {"analytic_story": ["ProxyShell", "Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505", "T1505.003", "T1190"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = [] action.notable.param.rule_description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. The analytic is limited to process name MSExchangeMailboxReplication.exe, which typically does not write .aspx files to disk. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. It is often the case that a particular threat is only applicable to a specific subset of systems in your environment. Typically analytics to detect those threats are written without the benefit of being able to only target those systems as well. Writing analytics against all systems when those behaviors are limited to identifiable subsets of those systems is suboptimal. Consider the case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, a hunter can limit their analytics to systems that have been identified as Exchange servers. A hunter may start with the theory that the exchange server is communicating with new systems that it has not previously. If this theory is run against all publicly facing systems, the amount of noise it will generate will likely render this theory untenable. However, using the asset information to limit this analytic to just the Exchange servers will reduce the noise allowing the hunter to focus only on the systems where this behavioral change is relevant. -action.notable.param.rule_title = Microsoft Exchange Mailbox Replication service writing Active Server Pages +action.notable.param.rule_title = MS Exchange Mailbox Replication service writing Active Server Pages action.notable.param.security_domain = endpoint action.notable.param.severity = high alert.digest_mode = 1 @@ -34373,7 +34373,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=MSExchangeMailboxReplication.exe by _time span=1h Processes.process_id Processes.process_name Processes.process_guid Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process process_guid] | dedup file_create_time | table dest file_create_time, file_name, file_path, process_name | `microsoft_exchange_mailbox_replication_service_writing_active_server_pages_filter` +search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=MSExchangeMailboxReplication.exe by _time span=1h Processes.process_id Processes.process_name Processes.process_guid Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process process_guid] | dedup file_create_time | table dest file_create_time, file_name, file_path, process_name | `ms_exchange_mailbox_replication_service_writing_active_server_pages_filter` [ESCU - Print Processor Registry Autostart - Rule] action.escu = 0 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 254ac1a763..93d7de4824 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:01 UTC +# On Date: 2022-03-21T07:44:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/workflow_actions.conf b/dist/escu/default/workflow_actions.conf index b7d95239e8..8246cb0254 100644 --- a/dist/escu/default/workflow_actions.conf +++ b/dist/escu/default/workflow_actions.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-03-15T15:18:01 UTC +# On Date: 2022-03-21T07:44:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com #############